6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.887 High
EPSS
Percentile
98.7%
CentOS Errata and Security Advisory CESA-2011:0843
Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL),
and TLS.
A heap-based buffer over-read flaw was found in the way Postfix performed
SASL handlers management for SMTP sessions, when Cyrus SASL authentication
was enabled. A remote attacker could use this flaw to cause the Postfix
smtpd server to crash via a specially-crafted SASL authentication request.
The smtpd process was automatically restarted by the postfix master process
after the time configured with service_throttle_time elapsed.
(CVE-2011-1720)
Note: Cyrus SASL authentication for Postfix is not enabled by default.
Red Hat would like to thank the CERT/CC for reporting this issue. Upstream
acknowledges Thomas Jarosch of Intra2net AG as the original reporter.
Users of Postfix are advised to upgrade to these updated packages, which
contain a backported patch to resolve this issue. After installing this
update, the postfix service will be restarted automatically.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2011-June/079767.html
https://lists.centos.org/pipermail/centos-announce/2011-June/079768.html
https://lists.centos.org/pipermail/centos-announce/2011-May/079757.html
https://lists.centos.org/pipermail/centos-announce/2011-May/079758.html
Affected packages:
postfix
postfix-pflogsumm
Upstream details at:
https://access.redhat.com/errata/RHSA-2011:0843
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 5 | i386 | postfix | < 2.3.3-2.3.el5_6 | postfix-2.3.3-2.3.el5_6.i386.rpm |
CentOS | 5 | i386 | postfix-pflogsumm | < 2.3.3-2.3.el5_6 | postfix-pflogsumm-2.3.3-2.3.el5_6.i386.rpm |
CentOS | 5 | x86_64 | postfix | < 2.3.3-2.3.el5_6 | postfix-2.3.3-2.3.el5_6.x86_64.rpm |
CentOS | 5 | x86_64 | postfix-pflogsumm | < 2.3.3-2.3.el5_6 | postfix-pflogsumm-2.3.3-2.3.el5_6.x86_64.rpm |
CentOS | 4 | i386 | postfix | < 2.2.10-1.5.el4 | postfix-2.2.10-1.5.el4.i386.rpm |
CentOS | 4 | i386 | postfix-pflogsumm | < 2.2.10-1.5.el4 | postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm |
CentOS | 4 | x86_64 | postfix | < 2.2.10-1.5.el4 | postfix-2.2.10-1.5.el4.x86_64.rpm |
CentOS | 4 | x86_64 | postfix-pflogsumm | < 2.2.10-1.5.el4 | postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm |