New Search

RHSA-2008:0839 -- postfix security update (Moderate)

oval:org.mitre.oval:def:28256

Updated postfix packages that fix a security issue are now available for Red Hat Enterprise Linux 3 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Postfix is a Mail Transport Agent (MTA) supporting LDAP SMTP AUTH (SASL) and TLS. A flaw was found in the way Postfix dereferences symbolic links. If a local user has write access to a mail spool directory with no root mailbox it may be possible for them to append arbitrary data to files that root has write permission to. (CVE-2008-2936) Red Hat would like to thank Sebastian Krahmer for responsibly disclosing this issue. All users of postfix should upgrade to these updated packages which contain a backported patch that resolves this issue.

Family:
unix
Status:
ACCEPTED
Platform(s):
  • CentOS Linux 3
  • CentOS Linux 5
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 3
  • Red Hat Enterprise Linux 5
Class:
patch
Reference(s):
  • RHSA-2008:0839
  • CESA-2008:0839-CentOS 3
  • CESA-2008:0839-CentOS 5
  • CVE-2008-2936
Product(s):
  • postfix