CVE-2008-2936 Privilege escalation in n/a

Medium 6.2 Published 18 Aug 2008 Updated 7 Aug 2024

Local attackers can escalate privileges by exploiting hard link handling in Postfix to append data to root-owned files via symlinks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2008-2936?

CVE-2008-2936 is a medium-severity vulnerability in n/a, published on 18 Aug 2008. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Weakness: CWE-264

Which versions are affected by CVE-2008-2936?

It affects 1 product.

Linux distribution packages (26)

`postfix` Red Hat:enterprise_linux:3::as	All versions	`2:2.0.16-14.1.RHEL3`
`postfix-debuginfo` Red Hat:enterprise_linux:3::as	All versions	`2:2.0.16-14.1.RHEL3`
`postfix` Red Hat:enterprise_linux:3::desktop	All versions	`2:2.0.16-14.1.RHEL3`
`postfix-debuginfo` Red Hat:enterprise_linux:3::desktop	All versions	`2:2.0.16-14.1.RHEL3`
`postfix` Red Hat:enterprise_linux:3::es	All versions	`2:2.0.16-14.1.RHEL3`
`postfix-debuginfo` Red Hat:enterprise_linux:3::es	All versions	`2:2.0.16-14.1.RHEL3`
`postfix` Red Hat:enterprise_linux:3::ws	All versions	`2:2.0.16-14.1.RHEL3`
`postfix-debuginfo` Red Hat:enterprise_linux:3::ws	All versions	`2:2.0.16-14.1.RHEL3`
`postfix` Red Hat:enterprise_linux:4::as	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix-pflogsumm` Red Hat:enterprise_linux:4::as	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix` Red Hat:enterprise_linux:4::desktop	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix-pflogsumm` Red Hat:enterprise_linux:4::desktop	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix` Red Hat:enterprise_linux:4::es	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix-pflogsumm` Red Hat:enterprise_linux:4::es	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix` Red Hat:enterprise_linux:4::ws	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix-pflogsumm` Red Hat:enterprise_linux:4::ws	All versions	`2:2.2.10-1.2.1.el4_7`
`postfix` Red Hat:enterprise_linux:5::client	All versions	`2:2.3.3-2.1.el5_2`
`postfix-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`2:2.3.3-2.1.el5_2`
`postfix-pflogsumm` Red Hat:enterprise_linux:5::client	All versions	`2:2.3.3-2.1.el5_2`
`postfix` Red Hat:enterprise_linux:5::server	All versions	`2:2.3.3-2.1.el5_2`
`postfix-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`2:2.3.3-2.1.el5_2`
`postfix-pflogsumm` Red Hat:enterprise_linux:5::server	All versions	`2:2.3.3-2.1.el5_2`

Products include Postfix Postfix.

How do I fix CVE-2008-2936?

Upgrade to a fixed version.

Is CVE-2008-2936 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-2936 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as DEBIAN-CVE-2008-2936, DSA-1629-1, DSA-1629-2, DTSA-155-1, GHSA-8739-vxjm-m9p4, RHSA-2008:0839.