Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file.

The remote NewStart CGSL host, running version MAIN 6.06, has postfix packages installed that are affected by multiple vulnerabilities:

  - The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3,     when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after     client authentication fails, which allows remote attackers to cause a denial of service (heap memory     corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one     method followed by an AUTH command with a different method. (CVE-2011-1720)

  - Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating     system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a     root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this     can be leveraged to gain privileges if there is a symlink to an init script. (CVE-2008-2936)

  - Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not     owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file     corresponding to another user's account name. (CVE-2008-2937)

  - Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6     kernel, leaks epoll file descriptors during execution of non-Postfix commands, which allows local users     to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a     command in a .forward file. (CVE-2008-3889)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

When exectuting external programs postfix didn't close the file descriptor of the epoll system call. This could potentially be exploited to shutdown postfix (CVE-2008-3889).

Wietse Venema discovered that Postfix leaked internal file descriptors when executing non-Postfix commands. A local attacker could exploit this to cause Postfix to run out of descriptors, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in Postfix 2.4 and later was discovered, when running on Linux kernel 2.6, where a local user could cause a denial of service due to Postfix leaking the epoll file descriptor when executing non-Postfix commands (CVE-2008-3889).

The updated packages have been patched to correct this issue.

New upstream patch level version 2.5.5, including multiple security fixes detailed in upstream announcements:
http://www.postfix.org/announcements/20080814.html http://www.postfix.org/announcements/20080902.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Postfix running on the remote host leaks 'epoll' file descriptors when it executes non-Postfix commands from, say, a user's .forward file. A local attacker can access the leaked epoll descriptor to launch a denial of service attack against Postfix.

Note that this issue only affects hosts running Linux with a 2.6 kernel.

The remote host is affected by the vulnerability described in GLSA-200809-09 (Postfix: Denial of Service)

    It has been discovered than Postfix leaks an epoll file descriptor when     executing external commands, e.g. user-controlled $HOME/.forward or     $HOME/.procmailrc files. NOTE: This vulnerability only concerns Postfix     instances running on Linux 2.6 kernels.
  Impact :

    A local attacker could exploit this vulnerability to reduce the     performance of Postfix, and possibly trigger an assertion, resulting in     a Denial of Service.
  Workaround :

    Allow only trusted users to control delivery to non-Postfix commands.

ID	Name	Product	Family	Severity
266252	NewStart CGSL MAIN 6.06 : postfix Multiple Vulnerabilities (NS-SA-2025-0220)	Nessus	NewStart CGSL Local Security Checks	critical
40112	openSUSE Security Update : postfix (postfix-194)	Nessus	SuSE Local Security Checks	low
36904	Ubuntu 7.10 / 8.04 LTS : postfix vulnerability (USN-642-1)	Nessus	Ubuntu Local Security Checks	low
36736	Mandriva Linux Security Advisory : postfix (MDVSA-2008:190)	Nessus	Mandriva Local Security Checks	low
34377	Fedora 8 : postfix-2.5.5-1.fc8 (2008-8595)	Nessus	Fedora Local Security Checks	medium
34376	Fedora 9 : postfix-2.5.5-1.fc9 (2008-8593)	Nessus	Fedora Local Security Checks	medium
34347	Postfix epoll File Descriptor Leak Local DoS	Nessus	SMTP problems	low
34248	GLSA-200809-09 : Postfix: Denial of Service	Nessus	Gentoo Local Security Checks	low
34240	openSUSE 10 Security Update : postfix (postfix-5603)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2008-3889

medium

Tenable Plugins

critical

low

low

low

medium

medium

low

low

low