Bug 456347 (CVE-2008-2937)

Summary: CVE-2008-2937 postfix improper mailbox permissions
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jlieskov, psklenar, redhat-bugzilla, security-response-team, twoerner, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-04-07 06:38:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 459099, 459100, 459101, 683386, 683387, 683389, 833971    
Bug Blocks:    
Attachments:
Description Flags
Patch Suse used none

Description Josh Bressers 2008-07-23 00:52:02 UTC 
Sebastian Krahmer discovered an issue in the way postfix handles mailboxes with
improper permissions and ownership.

It is possible for a user with permissions to create files in the mail spool
directory to create an insecure mailbox file for a known valid user.  This
mailbox will retain the insecure permissions and ownership allowing anyone to
view the data.

The easiest example of this would be a local user with the ability to write to
the mail spool creates a file named 'root' which postfix will then delivery
root's mail into regardless of file permissions or ownership.
Comment 1 Josh Bressers 2008-07-23 00:53:27 UTC 
This issue affects Red Hat Enterprise Linux 3, 4, and 5.
Comment 2 Josh Bressers 2008-08-14 13:27:43 UTC 
This is public:
http://marc.info/?l=full-disclosure&m=121871844101393&w=2
Comment 3 Josh Bressers 2008-08-14 13:42:03 UTC 
Created attachment 314316 [details]
Patch Suse used

Here is the patch Suse used.  I'm not sure where it came form, or if it's right, but from looking at it, it should work.
Comment 4 Josh Bressers 2008-08-14 22:38:11 UTC 
The above patch did come from postfix upstream.
Comment 5 Fedora Update System 2008-10-09 21:31:14 UTC 
postfix-2.5.5-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2008-10-09 21:33:04 UTC 
postfix-2.5.5-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 errata-xmlrpc 2011-04-06 23:00:05 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 4

Via RHSA-2011:0422 https://rhn.redhat.com/errata/RHSA-2011-0422.html
Comment 10 Vincent Danen 2011-04-06 23:30:36 UTC 
Acknowledgements:

Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for reporting this issue.



Statement:

(none)