CVE-2008-2937

Published: Aug 18, 2008Modified: Apr 23, 2026

1.9

Vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 3.4 / Impact: 2.9

Source: NVD

Description

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Affected (5)

Products: Postfix: Postfix

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Postfix Postfix	Version 2.5.0
Postfix Postfix	Version 2.5.1
Postfix Postfix	Version 2.5.2
Postfix Postfix	Version 2.5.3
Postfix Postfix	Version 2.6.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (38)

ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY (unsafe URL)

Source: secalert@redhat.com

ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.5.4.HISTORY (unsafe URL)

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00002.html

Source: secalert@redhat.com

http://secunia.com/advisories/31477

Source: secalert@redhat.com

http://secunia.com/advisories/31485

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/31500

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/32231

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200808-12.xml

Source: secalert@redhat.com

http://wiki.rpath.com/Advisories:rPSA-2008-0259

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:224

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0422.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/495632/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/30691

Source: secalert@redhat.com

Patch

http://www.vupen.com/english/advisories/2008/2385

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/44461

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-2689

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00287.html

Source: secalert@redhat.com

ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.5.4.HISTORY (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/31477

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/31485

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/31500

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://secunia.com/advisories/32231

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-200808-12.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://wiki.rpath.com/Advisories:rPSA-2008-0259

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2009:224

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-0422.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/495632/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/30691

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vupen.com/english/advisories/2008/2385

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/44461

Source: af854a3a-2127-422b-91ae-364da2661108

https://issues.rpath.com/browse/RPL-2689

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00287.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.