Paketname
postfix
Datum
2009-12-04
Advisory ID
MDVSA-2009:224-1
Betroffene Versionen
2008.0 i586 , 2008.0 x86_64

Problembeschreibung

A vulnerability has been found and corrected in postfix:

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a
mailbox file even when this file is not owned by the recipient, which
allows local users to read e-mail messages by creating a mailbox file
corresponding to another user's account name (CVE-2008-2937).

This update provides a solution to this vulnerability.

Update:

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Aktualisierte Pakete

2008.0 i586

 dcccce93e12e86c6828c5d0ab64b60db  2008.0/i586/libpostfix1-2.4.5-2.3mdv2008.0.i586.rpm
 20e55a81da8945bce9ba75a3fa0cc5ba  2008.0/i586/postfix-2.4.5-2.3mdv2008.0.i586.rpm
 bd80b48f07b01709fead701fb07b7d45  2008.0/i586/postfix-ldap-2.4.5-2.3mdv2008.0.i586.rpm
 3222bbb3c04c9b019b21ac022752872a  2008.0/i586/postfix-mysql-2.4.5-2.3mdv2008.0.i586.rpm
 5c94516257af665aa545c1d3192589b2  2008.0/i586/postfix-pcre-2.4.5-2.3mdv2008.0.i586.rpm
 a2391ec8cd9bb49c86f4b3c2ea9b0357  2008.0/i586/postfix-pgsql-2.4.5-2.3mdv2008.0.i586.rpm 
 c6d4a5c36d9131b02b42586cb3e0cacb  2008.0/SRPMS/postfix-2.4.5-2.3mdv2008.0.src.rpm

2008.0 x86_64

 bc509cca07a60d89f6e0fa3cd544ff65  2008.0/x86_64/lib64postfix1-2.4.5-2.3mdv2008.0.x86_64.rpm
 6f4849980bde480ea49dccbe05808f0c  2008.0/x86_64/postfix-2.4.5-2.3mdv2008.0.x86_64.rpm
 e23e7d6fe949fea7eb39d8c6a96aa0b5  2008.0/x86_64/postfix-ldap-2.4.5-2.3mdv2008.0.x86_64.rpm
 beabc7a8336eda0e789e923e793d9521  2008.0/x86_64/postfix-mysql-2.4.5-2.3mdv2008.0.x86_64.rpm
 c6d62f79b946ec7661fd1206811c71c5  2008.0/x86_64/postfix-pcre-2.4.5-2.3mdv2008.0.x86_64.rpm
 0e05a5809ee3301abce49c53afcb22a7  2008.0/x86_64/postfix-pgsql-2.4.5-2.3mdv2008.0.x86_64.rpm 
 c6d4a5c36d9131b02b42586cb3e0cacb  2008.0/SRPMS/postfix-2.4.5-2.3mdv2008.0.src.rpm

Referenzen