Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate with the target on the associated port.

The postfix mail transport agent in Debian 3.0 contains two vulnerabilities :

  - CAN-2003-0468: Postfix would allow an attacker to     bounce-scan private networks or use the daemon as a DDoS     tool by forcing the daemon to connect to an arbitrary     service at an arbitrary IP address and either receiving     a bounce message or observing queue operations to infer     the status of the delivery attempt.
  - CAN-2003-0540: a malformed envelope address can 1) cause     the queue manager to lock up until an entry is removed     from the queue and 2) lock up the smtp listener leading     to a denial of service.

Two vulnerabilities were discovered in the postfix MTA by Michal Zalewski. Versions prior to 1.1.12 would allow an attacker to bounce- scan private networks or use the daemon as a DDoS (Distributed Denial of Service) tool by forcing the daemon to connect to an arbitrary service at an arbitrary IP address and receiving either a bounce message or by timing. As well, versions prior to 1.1.12 have a bug where a malformed envelope address can cause the queue manager to lock up until an entry is removed from the queue and also lock up the SMTP listener leading to a DoS.

Postfix version 1.1.13 corrects these issues. The provided packages have been patched to fix the vulnerabilities.

The remote host is missing the patch for the advisory SUSE-SA:2003:033 (postfix).


Postfix is a flexible MTA replacement for sendmail.
Michal Zalewski has reported problems in postfix which can lead to a remote DoS attack or allow attackers to bounce-scan private networks.
These problems have been fixed. Even though not all of our products are vulnerable in their default configurations, the updates should be applied.

In order for the update to take effect, you have to restart your MTA by issuing the following command as root:

'/sbin/rcpostfix restart'


Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

The remote host is running a version of Postfix that is as old as or older than 1.1.12.

There are two vulnerabilities in this version that could allow an attacker to remotely disable it, or to be used as a DDoS agent against arbitrary hosts.

ID	Name	Product	Family	Severity
15200	Debian DSA-363-1 : postfix - denial of service, bounce-scanning	Nessus	Debian Local Security Checks	medium
14063	Mandrake Linux Security Advisory : postfix (MDKSA-2003:081)	Nessus	Mandriva Local Security Checks	medium
13802	SUSE-SA:2003:033: postfix	Nessus	SuSE Local Security Checks	medium
11820	Postfix < 2.0 Multiple Vulnerabilities	Nessus	SMTP problems	medium

Detections

Analytics

CVE-2003-0468

medium

Tenable Plugins

medium

medium

medium

medium