// For flags

CVE-2009-2939

 

Severity Score

6.9
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files.

El script postfix.postinst en el paquete postfix v2.5.5 de Debian GNU/Linux y Ubuntu permite acceso de escritura al usuario postfix en /var/spool/postfix/pid, permitiendo a usuarios locales dirigir ataques de enlaces simbólicos que sobrescriban ficheros de su elección.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-08-23 CVE Reserved
  • 2009-09-21 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-59: Improper Link Resolution Before File Access ('Link Following')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Postfix
Search vendor "Postfix"
Postfix
Search vendor "Postfix" for product "Postfix"
2.5.5
Search vendor "Postfix" for product "Postfix" and version "2.5.5"
-
Affected
in Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
6.06
Search vendor "Debian" for product "Debian Linux" and version "6.06"
-
Safe
Postfix
Search vendor "Postfix"
Postfix
Search vendor "Postfix" for product "Postfix"
2.5.5
Search vendor "Postfix" for product "Postfix" and version "2.5.5"
-
Affected
in Ubuntu
Search vendor "Ubuntu"
Ubuntu Linux
Search vendor "Ubuntu" for product "Ubuntu Linux"
4.0
Search vendor "Ubuntu" for product "Ubuntu Linux" and version "4.0"
-
Safe