CVE-2008-4977

** DISPUTED ** postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_groups.message temporary files. NOTE: the vendor disputes this vulnerability, stating "This is not a real issue ... users would have to edit a script under /usr/lib to enable it."

• CVE ID
• CVE-2008-4977

• Assigner
• cve@mitre.org

• Vulnerability Status
• Analyzed

• Published Version
• 2008-11-06T15:55:52

• Last Modified Date
• 2008-11-06T15:55:52

• Version
• 2.0

• Vector String
• AV:L/AC:M/Au:N/C:C/I:C/A:C

• Access Vector
• LOCAL

• Access Compatibility
• MEDIUM

• Authentication
• NONE

• Confidentiality Impact
• COMPLETE

• Integrity Impact
• COMPLETE

• Availability Impact
• COMPLETE

• Base Score
• 6.9

• Severity
• MEDIUM

• Exploitability Score
• 3.4

• Impact Score
• 10