|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2003-0540: postfix remote DoS | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Sebastian Krahmer <krahmer> |
| Component: | Incidents | Assignee: | Carsten Hoeger <choeger> |
| Status: | VERIFIED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | CVE-2003-0540: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: |
postfix patchinfo
postfix putonftp postfix putonftp |
||
|
Description
Sebastian Krahmer
2003-07-28 17:30:46 UTC
<!-- SBZ_reproduce --> Are we affected at all? We have postfix 2.x? We are effected up to SuSE Linux 8.1 (including UL and SLES8)... :-(((( I just tried to DoS a SLOX with success: Just do: telnet mailhost smtp ehlo hostname mail from: <.!> rcpt to: <nonexistent@addre.ss> after this part, no more mail is accepted anymore... :-( The message to detect that is different to that of the report: warning: resolve_clnt_query: bad read: Success We do not have a patch yet. I asked vendor-sec list. Should I send a laufzettel nevertheless? What do you need at all? It looks like mail relays (like cantor) are not effected. At least I was not able to reproduce the problem (thank god...). I'll try to find a fix myself in the meantime. Please tell me ASAP, if you get a fix from vendor-sec. I need the usual program: putonftp, patchinfo and laufzettel... It looks like it definetely is VERY dependent on the configuration in use. It looks like the author of the above report is overstating the situation. 1. He talks of nqmgr, which isn't used by default, because Wietse still does not trust it enough. 2. A postfix restart always results to a working system in my test cases, even if I use nqmgr. 3. Certain setups are NOT effected at all (see cantor) Okay, now that I have the additional info, that there'll be a patch from Wietse, and that we have an additional problem, I'll wait for this one... Created attachment 13232 [details]
postfix patchinfo
please add more to the description field if necessary
Created attachment 13233 [details]
postfix putonftp
Created attachment 13234 [details]
postfix putonftp
Old putonftp had a bug :)
From vendor-sec:
CAN-2003-0468 Bounce scanning issue fixed in Postfix 1.1-12
Postfix versions before 1.1.12 would allow an attacker to bounce-scan
private networks or use the daemon as a DDoS tool by forcing the daemon to
connect to an arbitrary service at an arbitrary IP address and receiving
either a bounce message or by timing.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0468
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0468 to this issue.
AN-2003-0540 Remote DoS
Postfix versions 1.1.12 and previous have a bug where a malformed
envelope address can 1) cause the queue manager to lock up until a
entry is removed from the queue and 2) lock up the smtp listener
leading to a DoS
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0540
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0540 to this issue.
Subject: Re: [lcamtuf@coredump.cx: Postfix up to 1.1.12 remote DoS (fwd)] (fwd) To: Michal Zalewski <lcamtuf@coredump.cx> Date: Mon, 28 Jul 2003 13:50:49 -0400 (EDT) Cc: Wietse Venema <wietse@porcupine.org> Message-Id: <20030728175049.D4A9BBC076@spike.porcupine.org> From: wietse@porcupine.org (Wietse Venema) Attached is a very simple bugfix for Postfix 1.1.12. I'd appreciate it if you could take a look. Unfortunately, I found no workarounds for sites that can't patch. Access restrictions on mail addresses are applied AFTER the address is resolved to standard form, and as we know that is too late. Turning off allow_percent_hack and swap_bangpath is not sufficient, because @.@local.tld still breaks Postfix in 1.1.* (but not earlier versions). The problem does not exist in MY OWN default configurations of Postfix 1.0.8 (a.k.a. postfix-20010228-pl08, released November 15, 2001) and postfix-19991231-pl13. To break Postfix one would have to turn off append_dot_mydomain, and use a slight variation of your exploit. Some package maintainers may or may not have changed this default. The same patch can be used here if desired. I haven't looked at earlier Postfix versions. I also haven't looked at other people's Postfix versions. How do we go from here? I am ready to package up Postfix 1.1.13 and send a note to the Postfix mailing lists that 1.1.13 fixes a problem with malformed addresses, with credits where it is due but no exploit information. That will give package maintainers time to roll out their own versions. I see little benefit in releasing patched Postfix versions for versions from two years ago; people can use the same patch as for 1.1.12. To summarize my understanding, the exploit with the envelope recipient address affects smtpd, and requires that one has relay access permission. The exploit with the Errors-To: or MAIL FROM address affects qmgr, and requires that mail is accepted then bounced. With Postfix < 2.0, any non-existent local address will do. Wietse diff -cr /tmp/postfix-1.1.12/src/trivial-rewrite/resolve.c src/trivial-rewrite/resolve.c *** /tmp/postfix-1.1.12/src/trivial-rewrite/resolve.c Fri Nov 22 12:32:33 2002 --- src/trivial-rewrite/resolve.c Mon Jul 28 11:36:49 2003 *************** *** 148,153 **** --- 148,154 ---- if (saved_domain) tok822_free_tree(saved_domain); saved_domain = domain; + domain = 0; } /* Can I close this bug? fixed CVE-2003-0540: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) |