Description
Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postfix | 2.5.4-1 | — |
| Debian 13 | postfix | 2.5.4-1 | — |
| Debian 12 | postfix | 2.5.4-1 | — |
| Debian 5.0 | postfix | 2.5.2-2lenny1 | DTSA-155-1 |
| Debian 4.0 | postfix | 2.3.8-2etch1 | DSA-1629-2, DSA-1629-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | postfix +1 | 2:2.3.3-2.1.el5_2 | RHSA-2008:0839 |
| RHEL 4 | postfix +1 | 2:2.2.10-1.2.1.el4_7 | RHSA-2008:0839 |
| RHEL 3 | postfix | 2:2.0.16-14.1.RHEL3 | RHSA-2008:0839 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Postfix 2.6-20080814 - 'symlink' Local Privilege Escalation EDB-6337 · local · Aug 31, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2008:0839 Red Hat Security Advisory: postfix security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1629-2 postfix - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1629-1 postfix - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-155-1 postfix - local privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2008-8595 vendor-advisory
- 32231 third-party-advisory
- 31469 third-party-advisory
- DSA-1629 vendor-advisory
- 31530 third-party-advisory
- FEDORA-2008-8593 vendor-advisory
- https://issues.rpath.com/browse/RPL-2689
- 1020700 vdb-entry
- 20080821 rPSA-2008-0259-1 postfix mailing-list
- VU#938323 third-party-advisory
- [postfix-announce] 20080814 Postfix local privilege escalation via hardlinked symlinks mailing-list
- 4160 third-party-advisory
- 30691 vdb-entry
- http://wiki.rpath.com/Advisories:rPSA-2008-0259
- SUSE-SA:2008:040 vendor-advisory
- 31474 third-party-advisory
- 20080831 PoCfix (PoC for Postfix local root vuln - CVE-2008-2936) mailing-list
- postfix-symlink-code-execution(44460) vdb-entry
- 6337 exploit
- RHSA-2008:0839 vendor-advisory
- 31500 third-party-advisory
- oval:org.mitre.oval:def:10033 vdb-entry signature
- 31477 third-party-advisory
- 31485 third-party-advisory
- USN-636-1 vendor-advisory
- MDVSA-2008:171 vendor-advisory
- 20080814 Postfix local privilege escalation via hardlinked symlinks mailing-list
- ADV-2008-2385 vdb-entry
- GLSA-200808-12 vendor-advisory