← Back to CVEs

CVE-2008-3889

N/A

Description

Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file.

CVE Details

CVSS v3.1 ScoreN/A

Published9/12/2008

Last Modified4/23/2026

Sourcenvd

Honeypot Sightings0

Affected Products

linux:linux_kernelpostfix:postfix

Weaknesses (CWE)

CWE-20

References

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html(cve@mitre.org)

http://secunia.com/advisories/31716(cve@mitre.org)

http://secunia.com/advisories/31800(cve@mitre.org)

http://secunia.com/advisories/31982(cve@mitre.org)

http://secunia.com/advisories/31986(cve@mitre.org)

http://secunia.com/advisories/32231(cve@mitre.org)

http://security.gentoo.org/glsa/glsa-200809-09.xml(cve@mitre.org)

http://securityreason.com/securityalert/4239(cve@mitre.org)

http://securitytracker.com/id?1020800(cve@mitre.org)

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0311(cve@mitre.org)

http://www.mandriva.com/security/advisories?name=MDVSA-2008:190(cve@mitre.org)

http://www.postfix.org/announcements/20080902.html(cve@mitre.org)

http://www.securityfocus.com/archive/1/495894/100/0/threaded(cve@mitre.org)

http://www.securityfocus.com/archive/1/496420/100/0/threaded(cve@mitre.org)

http://www.securityfocus.com/archive/1/498037/100/0/threaded(cve@mitre.org)

http://www.securityfocus.com/bid/30977(cve@mitre.org)

http://www.ubuntu.com/usn/usn-642-1(cve@mitre.org)

http://www.wekk.net/research/CVE-2008-3889/(cve@mitre.org)

https://exchange.xforce.ibmcloud.com/vulnerabilities/44865(cve@mitre.org)

https://www.exploit-db.com/exploits/6472(cve@mitre.org)

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html(cve@mitre.org)

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00287.html(cve@mitre.org)

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html(af854a3a-2127-422b-91ae-364da2661108)

http://secunia.com/advisories/31716(af854a3a-2127-422b-91ae-364da2661108)

http://secunia.com/advisories/31800(af854a3a-2127-422b-91ae-364da2661108)

http://secunia.com/advisories/31982(af854a3a-2127-422b-91ae-364da2661108)

http://secunia.com/advisories/31986(af854a3a-2127-422b-91ae-364da2661108)

http://secunia.com/advisories/32231(af854a3a-2127-422b-91ae-364da2661108)

http://security.gentoo.org/glsa/glsa-200809-09.xml(af854a3a-2127-422b-91ae-364da2661108)

http://securityreason.com/securityalert/4239(af854a3a-2127-422b-91ae-364da2661108)

http://securitytracker.com/id?1020800(af854a3a-2127-422b-91ae-364da2661108)

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0311(af854a3a-2127-422b-91ae-364da2661108)

http://www.mandriva.com/security/advisories?name=MDVSA-2008:190(af854a3a-2127-422b-91ae-364da2661108)

http://www.postfix.org/announcements/20080902.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/archive/1/495894/100/0/threaded(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/archive/1/496420/100/0/threaded(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/archive/1/498037/100/0/threaded(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/30977(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/usn-642-1(af854a3a-2127-422b-91ae-364da2661108)

http://www.wekk.net/research/CVE-2008-3889/(af854a3a-2127-422b-91ae-364da2661108)

https://exchange.xforce.ibmcloud.com/vulnerabilities/44865(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/6472(af854a3a-2127-422b-91ae-364da2661108)

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00287.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.