Description
The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the ".!" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a ".!" string, which causes an instance of the SMTP listener to lock up.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717 ↗
- http://www.securityfocus.com/bid/8333 ↗
- http://lists.grok.org.uk/pipermail/full-disclosure/2003-August/007693.html ↗
- http://www.kb.cert.org/vuls/id/895508 ↗
- http://marc.info/?l=bugtraq&m=106029188614704&w=2 ↗
- http://www.mandriva.com/security/advisories?name=MDKSA-2003:081 ↗
- http://www.redhat.com/support/errata/RHSA-2003-251.html ↗
- http://www.debian.org/security/2003/dsa-363 ↗
- http://marc.info/?l=bugtraq&m=106001525130257&w=2 ↗
- http://www.linuxsecurity.com/advisories/engarde_advisory-3517.html ↗
- http://www.novell.com/linux/security/advisories/2003_033_postfix.html ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A544 ↗
- http://secunia.com/advisories/9433 ↗