Gentoo: Postfix Local privilege escalation


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) Gentoo: Postfix Local privilege escalation
# 1  
Old 08-15-2008
Gentoo: Postfix Local privilege escalation

LinuxSecurity.com: Sebastian Krahmer of SuSE has found that Postfix allows to deliver mail to root-owned symlinks in an insecure manner under certain conditions. Normally, Postfix does not deliver mail to symlinks, except to root-owned symlinks, for compatibility with the systems using symlinks in /dev like Solaris. Furthermore, some systems like Linux allow to hardlink a symlink, while the POSIX.1-2001 standard requires that the symlink is followed.

More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
POSTQUEUE(1)						      General Commands Manual						      POSTQUEUE(1)

NAME
postqueue - Postfix queue control SYNOPSIS
postqueue [-c config_dir] -f postqueue [-c config_dir] -p postqueue [-c config_dir] -s site DESCRIPTION
The postqueue program implements the Postfix user interface for queue management. It implements all the operations that are traditionally available via the sendmail(1) command. The following options are recognized: -c config_dir The main.cf configuration file is in the named directory instead of the default configuration directory. See also the MAIL_CONFIG environment setting below. -f Flush the queue: attempt to deliver all queued mail. This option implements the traditional sendmail -q command, by contacting the Postfix qmgr(8) daemon. -p Produce a traditional sendmail-style queue listing. This option implements the traditional mailq command, by contacting the Postfix showq(8) daemon. -s site Schedule immediate delivery of all mail that is queued for the named site. The site must be eligible for the "fast flush" service. See flush(8) for more information about the "fast flush" service. This option implements the traditional sendmail -qRsite command, by contacting the Postfix flush(8) daemon. -v Enable verbose logging for debugging purposes. Multiple -v options make the software increasingly verbose. SECURITY
This program is designed to run with set-group ID privileges, so that it can connect to Postfix daemon processes. DIAGNOSTICS
Problems are logged to syslogd(8) and to the standard error stream. ENVIRONMENT
MAIL_CONFIG Directory with the main.cf file. In order to avoid exploitation of set-group ID privileges, it is not possible to specify arbitrary directory names. A non-standard directory is allowed only if the name is listed in the standard main.cf file, in the alternate_config_directories configuration parameter value. Only the super-user is allowed to specify arbitrary directory names. FILES
/var/spool/postfix, mail queue /etc/postfix, configuration files CONFIGURATION PARAMETERS
import_environment List of names of environment parameters that can be imported from non-Postfix processes. queue_directory Top-level directory of the Postfix queue. This is also the root directory of Postfix daemons that run chrooted. fast_flush_domains List of domains that will receive "fast flush" service (default: all domains that this system is willing to relay mail to). This list specifies the domains that Postfix accepts in the SMTP ETRN request and in the sendmail -qR command. SEE ALSO
sendmail(8) sendmail-compatible user interface qmgr(8) queue manager showq(8) list mail queue flush(8) fast flush service LICENSE
The Secure Mailer license must be distributed with this software. AUTHOR(S) Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA POSTQUEUE(1)