6551 : Postfix Bounce Scan / Packet Amplification DDoS
Printer | http://osvdb.org/6551 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
17	2476	about 9 years ago	about 5 years ago	0 times	90%

Timeline

Disclosure Date
2003-08-03

Description

Postfix contains a design flaw which may allow an attacker to use the mail server in SMTP 'bounce' scanning or even DDoS attacks. A specially crafted recipient field can cause the mail server to connect and communicate with an arbitrary host/port.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation, Misconfiguration
Impact: Impact Unknown
Exploit: Exploit Public

Solution

Upgrade to version 1.1.12 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: set append_dot_mydomain to "yes" and resolve_dequoted_address to "no".

Products

Wietse Venema	Postfix	1.1.0
		1.1.1
		1.1.10
		1.1.11
		1.1.2
		1.1.3
		1.1.4
		1.1.5
		1.1.6
		1.1.7
		1.1.8
		1.1.9

References

ISS X-Force ID: 12815
CVE ID: 2003-0468 (see also: NVD)
Bugtraq ID: 8361
Secunia Advisory ID: 9433
Vendor Specific Advisory URL: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717
http://www.debian.org/security/2003/dsa-363
http://www.linuxsecurity.com/advisories/engarde_advisory-3517.html
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:081
http://www.suse.de/de/security/2003_033_postfix.html
http://www.trustix.net/errata/misc/2003/TSL-2003-0029-postfix.asc.txt
Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=106001525130257&w=2
RedHat RHSA: RHSA-2003:251-07

Tools & Filters

	11820 13802 14063 15200

Credit

Michal Zalewski - lcamtufghettot.org -

CVSSv2 Score

CVSSv2 Base Score = 5.0
Source: nvd.nist.gov | Generated: 2003-12-31 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.