Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file.

When exectuting external programs postfix didn't close the file descriptor of the epoll system call. This could potentially be exploited to shutdown postfix (CVE-2008-3889).

Wietse Venema discovered that Postfix leaked internal file descriptors when executing non-Postfix commands. A local attacker could exploit this to cause Postfix to run out of descriptors, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in Postfix 2.4 and later was discovered, when running on Linux kernel 2.6, where a local user could cause a denial of service due to Postfix leaking the epoll file descriptor when executing non-Postfix commands (CVE-2008-3889).

The updated packages have been patched to correct this issue.

New upstream patch level version 2.5.5, including multiple security fixes detailed in upstream announcements:
http://www.postfix.org/announcements/20080814.html http://www.postfix.org/announcements/20080902.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Postfix running on the remote host leaks 'epoll' file descriptors when it executes non-Postfix commands from, say, a user's .forward file. A local attacker can access the leaked epoll descriptor to launch a denial of service attack against Postfix.

Note that this issue only affects hosts running Linux with a 2.6 kernel.

The remote host is affected by the vulnerability described in GLSA-200809-09 (Postfix: Denial of Service)

    It has been discovered than Postfix leaks an epoll file descriptor when     executing external commands, e.g. user-controlled $HOME/.forward or     $HOME/.procmailrc files. NOTE: This vulnerability only concerns Postfix     instances running on Linux 2.6 kernels.
  Impact :

    A local attacker could exploit this vulnerability to reduce the     performance of Postfix, and possibly trigger an assertion, resulting in     a Denial of Service.
  Workaround :

    Allow only trusted users to control delivery to non-Postfix commands.

ID	Name	Product	Family	Severity
40112	openSUSE Security Update : postfix (postfix-194)	Nessus	SuSE Local Security Checks	low
36904	Ubuntu 7.10 / 8.04 LTS : postfix vulnerability (USN-642-1)	Nessus	Ubuntu Local Security Checks	low
36736	Mandriva Linux Security Advisory : postfix (MDVSA-2008:190)	Nessus	Mandriva Local Security Checks	low
34377	Fedora 8 : postfix-2.5.5-1.fc8 (2008-8595)	Nessus	Fedora Local Security Checks	medium
34376	Fedora 9 : postfix-2.5.5-1.fc9 (2008-8593)	Nessus	Fedora Local Security Checks	medium
34347	Postfix epoll File Descriptor Leak Local DoS	Nessus	SMTP problems	low
34248	GLSA-200809-09 : Postfix: Denial of Service	Nessus	Gentoo Local Security Checks	low
34240	openSUSE 10 Security Update : postfix (postfix-5603)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2008-3889

medium

Tenable Plugins

low

low

low

medium

medium

low

low

low