Conectiva Information for VU#895508

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------

PACKAGE   : postfix
SUMMARY   : Remote denial of service vulnerability
DATE      : 2003-08-04 17:30:00
ID        : CLA-2003:717
RELEVANT
RELEASES  : 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
Postfix[1] is a widely used MTA (Mail Transport Agent, sometimes
called just an email or SMTP server).

This update for Conectiva Linux 7.0 and 8 fixes two vulnerabilities
in Postfix reported[4] by Michal Zalewski:

1. Postfix used as a bounce scanner (CAN-2003-0468)[2]
By using specially created recipients, it is possible to make Postfix
attempt to establish SMTP sessions with arbitrary hosts on arbitrary
ports. This could be used to identify open TCP ports on remote
machines or to just generate traffic.

2. Remote denial of service (CAN-2003-0540)[3]
A malformed address can be used to cause a denial of service
condition in two ways:
- by locking up the queue manager: the offending message has to be
manually removed from the queue in order to restore the service;
- by locking up the smtpd listener: when supplied with the malformed
address, the listener process will stop responding. Multiple attacks
in parallel will hang many smtpd processes, leading to a denial of
service.
In order to be vulnerable to this issue, the "append_dot_mydomain"
paramater would have to be changed from the default value of "on" to
"off".


Conectiva Linux 9 is not vulnerable to any of these issues since it
ships with Postfix 2.0.x.


SOLUTION
All postfix users should upgrade their packages. The service will be
automatically restarted after the upgrade if it was already running.


REFERENCES
1.http://www.postfix.org/
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0468
3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0540
4.http://www.securityfocus.com/archive/1/331713/2003-08-01/2003-08-07/0


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/postfix-1.1.13-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/postfix-1.1.13-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/postfix-doc-1.1.13-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/postfix-1.1.13-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/postfix-1.1.13-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/postfix-doc-1.1.13-1U80_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:

- run:                 apt-get update
- after that, execute: apt-get upgrade

Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE/LsuP42jd0JmAcZARAkSUAKCivRAFCAKjTgB6PgvM39MNhNkgxQCfRKSP
jPU9/qm3+LBktPbk8OYk3Jg=
=19Fy
-----END PGP SIGNATURE-----

Vendor Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.