CVE-2008-4977

postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_groups.message temporary files. NOTE: the vendor disputes this vulnerability, stating "This is not a real issue ... users would have to edit a script under /usr/lib to enable it.

• CWE-59

• http://bugs.debian.org/496401
• http://dev.gentoo.org/~rbu/security/debiantemp/postfixExploit
• http://www.openwall.com/lists/oss-security/2008/10/30/2
• https://bugs.gentoo.org/show_bug.cgi?id=235770
• https://bugs.gentoo.org/show_bug.cgi?id=235811
• http://bugs.debian.org/496401
• http://dev.gentoo.org/~rbu/security/debiantemp/postfixExploit
• http://www.openwall.com/lists/oss-security/2008/10/30/2
• https://bugs.gentoo.org/show_bug.cgi?id=235770
• https://bugs.gentoo.org/show_bug.cgi?id=235811

Published

Nov 6, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4971mafft-homologs in mafft 6.240 allows local users to overwrit…
• CVE-2008-4972mailgo in mgt 2.31 allows local users to overwrite arbitrary…
• CVE-2008-4973i2myspell in myspell 3.1 allows local users to overwrite arb…
• CVE-2008-4974rrdedit in netmrg 0.20 allows local users to overwrite arbit…
• CVE-2008-4975mkmailpost in newsgate 1.6 allows local users to overwrite a…
• CVE-2008-4976ogle 0.9.2 and ogle-mmx 0.9.2 allow local users to overwrite…
• CVE-2008-4978radiance 3R9+20080530 allows local users to overwrite arbitr…
• CVE-2008-4979getipacctg in rancid 2.3.2~a8 allows local users to overwrit…
• CVE-2008-4980delqueueask in rccp 0.9 allows local users to overwrite arbi…
• CVE-2008-4981perl.robot in realtimebattle 1.0.8 allows local users to ove…
• CVE-2008-4982rkhunter in rkhunter 1.3.2 allows local users to overwrite a…
• CVE-2008-4983scilab-bin 4.1.2 allows local users to overwrite arbitrary f…