Zero-friction vulnerability management platform

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Debian Security Advisory DSA 1629-2 (postfix)

Information

Severity

Severity

Medium

Family

Family

Debian Local Security Checks

CVSSv2 Base

CVSSv2 Base

6.2

CVSSv2 Vector

CVSSv2 Vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Solution Type

Solution Type

Vendor Patch

Created

Created

13 years ago

Modified

Modified

5 years ago

Summary

The remote host is missing an update to postfix announced via advisory DSA 1629-2.

Insight

Insight

Due to a version numbering problem, the Postfix update for DSA 1629 was not installable on the i386 (Intel ia32) architecture. This update increases the version number to make it installable on i386 as well. For reference the original advisory text is below. Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox. In some configurations, this allows for appending data to arbitrary files as root. Note that only specific configurations are vulnerable the default Debian installation is not affected. Only a configuration meeting the following requirements is vulnerable: * The mail delivery style is mailbox, with the Postfix built-in local(8) or virtual(8) delivery agents. * The mail spool directory (/var/spool/mail) is user-writeable. * The user can create hardlinks pointing to root-owned symlinks located in other directories. For a detailed treating of the issue, please refer to the upstream author's announcement: http://article.gmane.org/gmane.mail.postfix.announce/110 For the stable distribution (etch), this problem has been fixed in version 2.3.8-2+etch1. For the testing distribution (lenny), this problem has been fixed in version 2.5.2-2lenny1. For the unstable distribution (sid), this problem has been fixed in version 2.5.4-1. We recommend that you upgrade your postfix package.

Solution

Solution

https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201629-2

Common Vulnerabilities and Exposures (CVE)