CVE-2008-4977

Publication date 6 November 2008

Last updated 4 August 2025

Ubuntu priority

Low

Why this priority?

postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_groups.message temporary files. NOTE: the vendor disputes this vulnerability, stating “This is not a real issue ... users would have to edit a script under /usr/lib to enable it.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
postfix 9.04 jaunty Ignored
8.10 intrepid Ignored
8.04 LTS hardy Ignored
7.10 gutsy Ignored end of life
6.06 LTS dapper Ignored

Notes

jdstrand

per Debian, Not enabled by default, needs manual modification of a script