← Vulnerability feed

Vulnerability record · CVE-2008-4977 · published 6 November 2008

CVE-2008-4977: Postfix link following vulnerability

Postfix · Postfix

postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_groups.message temporary files. NOTE: the vendor disputes this vulnerability, stating "This is not a real issue ... users would have to edit a script under /usr/lib to enable it.

6.9 CVSS 2.0 Medium EPSS 0.37% · top 71.2% CWE-59 · Link following
6.9CVSS 2.0 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_groups.message temporary files. NOTE: the vendor disputes this vulnerability, stating "This is not a real issue ... users would have to edit a script under /usr/lib to enable it.

AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://bugs.debian.org/496401
http://dev.gentoo.org/~rbu/security/debiantemp/postfix Exploit
http://www.openwall.com/lists/oss-security/2008/10/30/2
https://bugs.gentoo.org/show_bug.cgi?id=235770
https://bugs.gentoo.org/show_bug.cgi?id=235811
http://bugs.debian.org/496401
http://dev.gentoo.org/~rbu/security/debiantemp/postfix Exploit
http://www.openwall.com/lists/oss-security/2008/10/30/2
https://bugs.gentoo.org/show_bug.cgi?id=235770
https://bugs.gentoo.org/show_bug.cgi?id=235811

Track CVE-2008-4977 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2017-10140Postfix vulnerabilityPostfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undo…EPSS 0.55%7.5CVE-2026-43964Postfix vulnerabilityPostfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code th…EPSS 0.88%6.9CVE-2009-2939Postfix link following vulnerabilityThe postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, …EPSS 0.50%6.8CVE-2011-1720Postfix memory buffer overflow vulnerabilityThe SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication met…EPSS 21%6.8CVE-2011-0411Postfix permissions and access controls vulnerabilityThe STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restric…EPSS 16%6.5CVE-2012-0811Postfix sql injection vulnerabilityMultiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL com…EPSS 1.7%6.2CVE-2008-2936Postfix permissions and access controls vulnerabilityPostfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, al…EPSS 0.99%5.3CVE-2023-51764Postfix insufficient verification of data authenticity vulnerabilityPostfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=c…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2008-4977), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.