Postfix mail server IPv6 configuration unauthorized mail relaying

In specific configurations, for example if ran in chroot environment on IPv6 network, message relaying is not limited allowing relay to be used for SPAM sending...

USN-74-1: Postfix vulnerability

Jean-Samuel Reynaud noticed a programming error in the IPv6 handling code of Postfix when /proc/net/ifinet6 is not available which is the case in Ubuntu since Postfix runs in a chroot. If "permitmxbackup" was enabled in the "smtpdrecipientrestrictions", Postfix turned into an open relay, i. e...

CVE-2004-0925

Postfix on Mac OS X 10.3.x through 10.3.5, with SMTPD AUTH enabled, does not properly clear the username between authentication attempts, which allows users with the longest username to prevent other valid users from being able to authenticate...

CVE-2004-1113

SQL injection vulnerability in SQLgrey Postfix greylisting service before 1.2.0 allows remote attackers to execute arbitrary SQL commands via the 1 sender or 2 recipient e-mail addresses...

DEBIAN-CVE-2004-1113

SQL injection vulnerability in SQLgrey Postfix greylisting service before 1.2.0 allows remote attackers to execute arbitrary SQL commands via the 1 sender or 2 recipient e-mail addresses...

CVE-2004-1088

Postfix server for Apple Mac OS X 10.3.6, when using CRAM-MD5, allows remote attackers to send mail without authentication by replaying authentication information...

CVE-2004-1113

SQL injection vulnerability in SQLgrey Postfix greylisting service before 1.2.0 allows remote attackers to execute arbitrary SQL commands via the 1 sender or 2 recipient e-mail addresses...

CVE-2004-1113

CVE-2004-1113 affects the SQLgrey Postfix greylisting service, specifically versions before 1.2.0. The vulnerability is a SQL injection in which an attacker can cause arbitrary SQL commands to be executed via the (1) sender and (2) recipient e‑mail addresses. The root cause is untrusted input bei...

CVE-2004-1113

SQL injection vulnerability in SQLgrey Postfix greylisting service before 1.2.0 allows remote attackers to execute arbitrary SQL commands via the 1 sender or 2 recipient e-mail addresses...

CVE-2004-1113: Undefined Security Weakness

SQL injection vulnerability in SQLgrey Postfix greylisting service before 1.2.0 allows remote attackers to execute arbitrary SQL commands via the 1 sender or 2 recipient e-mail addresses...

[SA13135] SQLgrey Postfix greylisting service Unspecified SQL Injection

---------------------------------------------------------------------- Monitor, Filter, and Manage Security Information - Filtering and Management of Secunia advisories - Overview, documentation, and detailed reports - Alerting via email and SMS Request Trial: https://ca.secunia.com/?f=l...

CVE-2004-0925

CVE-2004-0925 affects Postfix on Mac OS X 10.3.x through 10.3.5 with SMTPD AUTH enabled. The root cause is that the username is not properly cleared between authentication attempts, allowing the user with the longest username to prevent other valid users from authenticating. The connected documen...

CVE-2004-0925

Postfix on Mac OS X 10.3.x through 10.3.5, with SMTPD AUTH enabled, does not properly clear the username between authentication attempts, which allows users with the longest username to prevent other valid users from being able to authenticate...

CVE-2004-0925: Undefined Security Weakness

Postfix on Mac OS X 10.3.x through 10.3.5, with SMTPD AUTH enabled, does not properly clear the username between authentication attempts, which allows users with the longest username to prevent other valid users from being able to authenticate...

Debian DSA-093-1 : postfix - remote DoS

Wietse Venema reported he found a denial of service vulnerability in postfix. The SMTP session log that postfix keeps for debugging purposes could grow to an unreasonable size. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

Debian DSA-363-1 : postfix - denial of service, bounce-scanning

The postfix mail transport agent in Debian 3.0 contains two vulnerabilities : - CAN-2003-0468: Postfix would allow an attacker to bounce-scan private networks or use the daemon as a DDoS tool by forcing the daemon to connect to an arbitrary service at an arbitrary IP address and either receiving ...

Mandrake Linux Security Advisory : postfix (MDKSA-2001:089)

Wietse Venema, the author of postfix, reported a vulnerability in the SMTP server where a remote attacker could execute a Denial of Service attack on it. The SMTP session log could grow to an unreasonable size and could possibly exhause the server's memory if no other limits were enforced...

Mandrake Linux Security Advisory : postfix (MDKSA-2003:081)

Two vulnerabilities were discovered in the postfix MTA by Michal Zalewski. Versions prior to 1.1.12 would allow an attacker to bounce- scan private networks or use the daemon as a DDoS Distributed Denial of Service tool by forcing the daemon to connect to an arbitrary service at an arbitrary IP...

SUSE-SA:2003:033: postfix

The remote host is missing the patch for the advisory SUSE-SA:2003:033 postfix. Postfix is a flexible MTA replacement for sendmail. Michal Zalewski has reported problems in postfix which can lead to a remote DoS attack or allow attackers to bounce-scan private networks. These problems have been...

DEBIAN-CVE-2003-0468

Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate...