CVE-2008-3889

Published Sep 12, 2008

Last updated a month ago

Overview

Description
Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file.
Source
cve@mitre.org
NVD status
Deferred

Risk scores

CVSS 2.0

Type
Primary
Base score
2.1
Impact score
2.9
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

nvd@nist.gov
CWE-20

Social media

Hype score
Not currently trending

Vendor comments

  • Red HatNot vulnerable. This issue did not affect the versions Postfix as shipped with Red Hat Enterprise Linux 3, 4, or 5.

Configurations

References

Sources include official advisories and independent security research.