CVE-2009-2939

EUVD-2009-2927
The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.9 UNKNOWN
LOCAL
MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 6%
Affected Products (NVD)
VendorProductVersion
postfixpostfix
2.5.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
postfix
bookworm
3.7.11-0+deb12u1
fixed
bullseye
3.5.25-0+deb11u1
fixed
etch
no-dsa
sid
3.9.0-3
fixed
trixie
3.9.0-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postfix
dapper
Fixed 2.2.10-1ubuntu0.3
released
hardy
Fixed 2.5.1-2ubuntu1.3
released
intrepid
ignored
jaunty
ignored
karmic
Fixed 2.6.5-3
released
lucid
Fixed 2.6.5-3
released
maverick
Fixed 2.6.5-3
released
Common Weakness Enumeration
References
http://www.debian.org/security/2011/dsa-2233
http://www.openwall.com/lists/oss-security/2009/09/18/6
http://www.debian.org/security/2011/dsa-2233
http://www.openwall.com/lists/oss-security/2009/09/18/6