CVE-2008-2937

postfix improper mailbox permissions

Severity Score

10.0

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Postfix 2.5 anterior a 2.5.4 y 2.6 anterior a 2.6-20080814 envía a un archivo buzón incluso cuando este archivo no es propiedad del receptor, lo que permite a usuarios locales leer mensajes de correo creando un archivo buzón correspondiente con el nombre de cuenta de otro usuario.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-06-30 CVE Reserved
2008-08-18 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (21)

URL	Tag	Source
ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY	X_refsource_confirm
ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.5.4.HISTORY	X_refsource_confirm
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705	X_refsource_confirm
http://secunia.com/advisories/31477	Third Party Advisory
http://secunia.com/advisories/32231	Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2008-0259	X_refsource_confirm
http://www.securityfocus.com/archive/1/495632/100/0/threaded	Mailing List
http://www.vupen.com/english/advisories/2008/2385	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/44461	Vdb Entry
https://issues.rpath.com/browse/RPL-2689	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/31500	2018-10-11
http://www.securityfocus.com/bid/30691	2018-10-11

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00002.html	2018-10-11
http://secunia.com/advisories/31485	2018-10-11
http://security.gentoo.org/glsa/glsa-200808-12.xml	2018-10-11
http://www.mandriva.com/security/advisories?name=MDVSA-2009:224	2018-10-11
http://www.redhat.com/support/errata/RHSA-2011-0422.html	2018-10-11
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html	2018-10-11
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00287.html	2018-10-11
https://access.redhat.com/security/cve/CVE-2008-2937	2011-04-06
https://bugzilla.redhat.com/show_bug.cgi?id=456347	2011-04-06

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Postfix Search vendor "Postfix"		Postfix Search vendor "Postfix" for product "Postfix"				2.5.0 Search vendor "Postfix" for product "Postfix" and version "2.5.0"		-		Affected
Postfix Search vendor "Postfix"		Postfix Search vendor "Postfix" for product "Postfix"				2.5.1 Search vendor "Postfix" for product "Postfix" and version "2.5.1"		-		Affected
Postfix Search vendor "Postfix"		Postfix Search vendor "Postfix" for product "Postfix"				2.5.2 Search vendor "Postfix" for product "Postfix" and version "2.5.2"		-		Affected
Postfix Search vendor "Postfix"		Postfix Search vendor "Postfix" for product "Postfix"				2.5.3 Search vendor "Postfix" for product "Postfix" and version "2.5.3"		-		Affected
Postfix Search vendor "Postfix"		Postfix Search vendor "Postfix" for product "Postfix"				2.6.0 Search vendor "Postfix" for product "Postfix" and version "2.6.0"		-		Affected