SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Postfix Vendors:   Postfix.org
(Conectiva Issues Fix) Postfix Address Resolver Parsing Bug Lets Remote Users Hang the System
SecurityTracker Alert ID:  1007410
SecurityTracker URL:  http://securitytracker.com/id/1007410
CVE Reference:   CVE-2003-0540   (Links to External Site)
Date:  Aug 5 2003
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.1.12 and prior versions
Description:   A denial of service vulnerability was reported in Postfix. A remote user may be able to cause the queue manager to lock up.

It is reported that the address parser code contains a flaw. A remote user can create a specially crafted envelope address in the SMTP header to cause the 'nqmgr' process to lock up. The exploit message's destination address must reportedly be crafted to cause a bounce (e.g., "<nonexistent@local-server-name>", "<nonexistent@[127.0.0.1]>") and the "mail from" or "Errors-To" addresses must reportedly be of the form "<.!>" or "<.!@local-server-name>". According to the report, when the code attempts to parse and rewrite the from/error address, the queue manager will lock up.

The offending message must be removed before the queue manager is restarted in order to return to normal operations.

It is also reported that a remote user can cause an instance of the SMTP listener to lock up by sending a specially crafted "RCPT TO" address of the form "<.!>" or "<.!@local-server-name>". By repeating this method, the remote user can cause denial of service conditions.

The report indicates that the system will write the following messasge to the mail log file when the flaw is triggered:

"resolve_clnt_query: null recipient"

Versions prior to 1.1.9 are not vulnerable in the default configuration, unless the 'append_dot_mydomain' setting is disabled via the configuration file.

Version 2.0 is not affected, according to the report.

The vendor was reportedly notified on July 27, 2003.

Impact:   A remote user can cause the queue manager to lock up until the exploit message is removed from the queue.

A remote user can cause a single instance of the SMTP listener to lock up until the exploit message is removed from the queue.

Solution:   Conectiva has released a fix.

ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/postfix-1.1.13-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/postfix-1.1.13-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/postfix-doc-1.1.13-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/postfix-1.1.13-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/postfix-1.1.13-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/postfix-doc-1.1.13-1U80_1cl.i386.rpm

Vendor URL:  www.postfix.org/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Conectiva)
Underlying OS Comments:  7.0, 8

Message History:   This archive entry is a follow-up to the message listed below.
Aug 4 2003 Postfix Address Resolver Parsing Bug Lets Remote Users Hang the System



 Source Message Contents

Subject:  [conectiva-updates] [CLA-2003:717] Conectiva Security Announcement - postfix


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : postfix
SUMMARY   : Remote denial of service vulnerability
DATE      : 2003-08-04 17:30:00
ID        : CLA-2003:717
RELEVANT
RELEASES  : 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
 Postfix[1] is a widely used MTA (Mail Transport Agent, sometimes
 called just an email or SMTP server).
 
 This update for Conectiva Linux 7.0 and 8 fixes two vulnerabilities
 in Postfix reported[4] by Michal Zalewski:
 
 1. Postfix used as a bounce scanner (CAN-2003-0468)[2]
 By using specially created recipients, it is possible to make Postfix
 attempt to establish SMTP sessions with arbitrary hosts on arbitrary
 ports. This could be used to identify open TCP ports on remote
 machines or to just generate traffic.
 
 2. Remote denial of service (CAN-2003-0540)[3]
 A malformed address can be used to cause a denial of service
 condition in two ways:
 - by locking up the queue manager: the offending message has to be
 manually removed from the queue in order to restore the service;
 - by locking up the smtpd listener: when supplied with the malformed
 address, the listener process will stop responding. Multiple attacks
 in parallel will hang many smtpd processes, leading to a denial of
 service.
 In order to be vulnerable to this issue, the "append_dot_mydomain"
 paramater would have to be changed from the default value of "on" to
 "off".
 
 
 Conectiva Linux 9 is not vulnerable to any of these issues since it
 ships with Postfix 2.0.x.


SOLUTION
 All postfix users should upgrade their packages. The service will be
 automatically restarted after the upgrade if it was already running.
 
 
 REFERENCES
 1.http://www.postfix.org/
 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0468
 3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0540
 4.http://www.securityfocus.com/archive/1/331713/2003-08-01/2003-08-07/0


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/postfix-1.1.13-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/postfix-1.1.13-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/postfix-doc-1.1.13-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/postfix-1.1.13-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/postfix-1.1.13-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/postfix-doc-1.1.13-1U80_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE/LsuP42jd0JmAcZARAkSUAKCivRAFCAKjTgB6PgvM39MNhNkgxQCfRKSP
jPU9/qm3+LBktPbk8OYk3Jg=
=19Fy
-----END PGP SIGNATURE-----



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC