[CLA-2003:717] Conectiva Security Announcement - postfix

From: Conectiva Updates (secure_at_conectiva.com.br)
Date: 08/04/03

  • Next message: pask_at_cmlc.upv.es: "Local Vulnerability in IBM DB2 7.1 db2job binary"
    Date: Mon, 4 Aug 2003 18:09:36 -0300
    To: conectiva-updates@papaleguas.conectiva.com.br, lwn@lwn.net, bugtraq@securityfocus.com, security-alerts@linuxsecurity.com, linsec@lists.seifried.org
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - --------------------------------------------------------------------------
    CONECTIVA LINUX SECURITY ANNOUNCEMENT
    - --------------------------------------------------------------------------

    PACKAGE : postfix
    SUMMARY : Remote denial of service vulnerability
    DATE : 2003-08-04 17:30:00
    ID : CLA-2003:717
    RELEVANT
    RELEASES : 7.0, 8

    - -------------------------------------------------------------------------

    DESCRIPTION
     Postfix[1] is a widely used MTA (Mail Transport Agent, sometimes
     called just an email or SMTP server).
     
     This update for Conectiva Linux 7.0 and 8 fixes two vulnerabilities
     in Postfix reported[4] by Michal Zalewski:
     
     1. Postfix used as a bounce scanner (CAN-2003-0468)[2]
     By using specially created recipients, it is possible to make Postfix
     attempt to establish SMTP sessions with arbitrary hosts on arbitrary
     ports. This could be used to identify open TCP ports on remote
     machines or to just generate traffic.
     
     2. Remote denial of service (CAN-2003-0540)[3]
     A malformed address can be used to cause a denial of service
     condition in two ways:
     - by locking up the queue manager: the offending message has to be
     manually removed from the queue in order to restore the service;
     - by locking up the smtpd listener: when supplied with the malformed
     address, the listener process will stop responding. Multiple attacks
     in parallel will hang many smtpd processes, leading to a denial of
     service.
     In order to be vulnerable to this issue, the "append_dot_mydomain"
     paramater would have to be changed from the default value of "on" to
     "off".
     
     
     Conectiva Linux 9 is not vulnerable to any of these issues since it
     ships with Postfix 2.0.x.

    SOLUTION
     All postfix users should upgrade their packages. The service will be
     automatically restarted after the upgrade if it was already running.
     
     
     REFERENCES
     1.http://www.postfix.org/
     2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0468
     3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0540
     4.http://www.securityfocus.com/archive/1/331713/2003-08-01/2003-08-07/0

    UPDATED PACKAGES
    ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/postfix-1.1.13-1U70_1cl.src.rpm
    ftp://atualizacoes.conectiva.com.br/7.0/RPMS/postfix-1.1.13-1U70_1cl.i386.rpm
    ftp://atualizacoes.conectiva.com.br/7.0/RPMS/postfix-doc-1.1.13-1U70_1cl.i386.rpm
    ftp://atualizacoes.conectiva.com.br/8/SRPMS/postfix-1.1.13-1U80_1cl.src.rpm
    ftp://atualizacoes.conectiva.com.br/8/RPMS/postfix-1.1.13-1U80_1cl.i386.rpm
    ftp://atualizacoes.conectiva.com.br/8/RPMS/postfix-doc-1.1.13-1U80_1cl.i386.rpm

    ADDITIONAL INSTRUCTIONS
     The apt tool can be used to perform RPM packages upgrades:

     - run: apt-get update
     - after that, execute: apt-get upgrade

     Detailed instructions reagarding the use of apt and upgrade examples
     can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

    - -------------------------------------------------------------------------
    All packages are signed with Conectiva's GPG key. The key and instructions
    on how to import it can be found at
    http://distro.conectiva.com.br/seguranca/chave/?idioma=en
    Instructions on how to check the signatures of the RPM packages can be
    found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

    - -------------------------------------------------------------------------
    All our advisories and generic update instructions can be viewed at
    http://distro.conectiva.com.br/atualizacoes/?idioma=en

    - -------------------------------------------------------------------------
    Copyright (c) 2003 Conectiva Inc.
    http://www.conectiva.com

    - -------------------------------------------------------------------------
    subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
    unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.6 (GNU/Linux)
    Comment: For info see http://www.gnupg.org

    iD8DBQE/LsuP42jd0JmAcZARAkSUAKCivRAFCAKjTgB6PgvM39MNhNkgxQCfRKSP
    jPU9/qm3+LBktPbk8OYk3Jg=
    =19Fy
    -----END PGP SIGNATURE-----


  • Next message: pask_at_cmlc.upv.es: "Local Vulnerability in IBM DB2 7.1 db2job binary"

    Relevant Pages