CVE-2017-10140
High · 7.8CVSS
7.8
EPSS
0.5%
Published
Apr 16, 2018
CISA due date
—
Cloudanix analysis
A flaw in older email server software could let someone with basic access on the computer take over the entire system and read private emails.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Low
- Impact
- Privilege Gain
- Component
- Application
- Class
- Privilege Escalation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The vulnerability allows a local user to escalate privileges by causing Postfix to read attacker-controlled settings from a DB_CONFIG file in the current working directory, exploiting undocumented Berkeley DB functionality.
Why it matters to the business
Attackers with local access can gain elevated privileges on mail servers, leading to full system compromise, data breaches, or service disruption. This affects organizations running older Postfix versions on systems with Berkeley DB.
How an attack unfolds
An attacker with local access creates a malicious DB_CONFIG file in a directory from which Postfix components are invoked, leveraging Berkeley DB's behavior to read configuration settings that grant elevated privileges.
How to fix it
Upgrade Postfix to version 2.11.10 or later, 3.0.10 or later, 3.1.6 or later, or 3.2.2 or later. Ensure that Postfix does not run from untrusted directories and restrict local user access where possible.
How to confirm the fix worked
Verify Postfix version is updated to a fixed release. Check for absence of DB_CONFIG files in directories used by Postfix processes. Review system configurations for Berkeley DB usage.
Typical attack path
- Obtain local user access to the system
- Create a directory containing a crafted DB_CONFIG file
- Execute or trigger Postfix processes from that directory to load the malicious settings
- Escalate privileges to root or mail administrator
How to detect it
Examine system logs for Postfix processes loading unexpected configuration files. Look for DB_CONFIG files in user-writable directories or those used by mail services. Monitor for unusual privilege changes involving mail-related processes.
- DB_CONFIG
- postfix.*DB_CONFIG
- berkeley db config in cwd
What your security team should do
- Immediately upgrade Postfix to a patched version
- Audit local users and restrict unnecessary access to mail server
- Monitor for privilege escalation attempts
- Implement directory restrictions for service accounts
The record
Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | db5.3 | 0 | 5.3.28-13.1 |
| Debian:12 | db5.3 | 0 | 5.3.28-13.1 |
| Debian:13 | db5.3 | 0 | 5.3.28-13.1 |
| Debian:7 | db | 0 | 5.1.29-5+deb7u1 |
| Debian:7 | db4.7 | 0 | 4.7.25-21+deb7u1 |
| Debian:7 | db4.8 | 0 | 4.8.30-12+deb7u1 |
| Mageia:5 | db48 | 0 | 4.8.30-18.1.mga5 |
| Mageia:5 | db53 | 0 | 5.3.28-4.1.mga5 |
| Mageia:6 | db48 | 0 | 4.8.30-21.1.mga6 |
| Mageia:6 | db53 | 0 | 5.3.28-10.1.mga6 |
| Ubuntu:14.04:LTS | db5.3 | 0 | 5.3.28-3ubuntu3.1 |
| Ubuntu:16.04:LTS | db5.3 | 0 | 5.3.28-11ubuntu0.1 |
| Ubuntu:18.04:LTS | db5.3 | 0 | 5.3.28-13.1 |