The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.

Remote attackers could potentially exploit a memory corruption issue in postfix' SASL implementation to execute arbitrary code (CVE-2011-1720).

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0843 advisory.

    [2:2.6.6-2.2]
    - fix CVE-2011-1720 (#704136)       Resolves: rhbz#704136

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS.

A heap-based buffer over-read flaw was found in the way Postfix performed SASL handlers management for SMTP sessions, when Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause the Postfix smtpd server to crash via a specially crafted SASL authentication request. The smtpd process was automatically restarted by the postfix master process after the time configured with service_throttle_time elapsed. (CVE-2011-1720)

Note: Cyrus SASL authentication for Postfix is not enabled by default.

Users of Postfix are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, the postfix service will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201206-33 (Postfix: Multiple vulnerabilities)

    A vulnerability have been discovered in Postfix. Please review the CVE       identifier referenced below for details.
  Impact :

    An attacker could perform a man-in-the-middle attack and inject SMTP       commands during the plaintext to TLS session switch or might execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

Remote attackers could have potentially exploited a memory corruption issue in postfix' SASL implementation to execute arbitrary code (CVE-2011-1720). This has been fixed.

Thomas Jarosch discovered that Postfix incorrectly handled authentication mechanisms other than PLAIN and LOGIN when the Cyrus SASL library is used. A remote attacker could use this to cause Postfix to crash, leading to a denial of service, or possibly execute arbitrary code as the postfix user.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS.

A heap-based buffer over-read flaw was found in the way Postfix performed SASL handlers management for SMTP sessions, when Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause the Postfix smtpd server to crash via a specially crafted SASL authentication request. The smtpd process was automatically restarted by the postfix master process after the time configured with service_throttle_time elapsed. (CVE-2011-1720)

Note: Cyrus SASL authentication for Postfix is not enabled by default.

Red Hat would like to thank the CERT/CC for reporting this issue.
Upstream acknowledges Thomas Jarosch of Intra2net AG as the original reporter.

Users of Postfix are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, the postfix service will be restarted automatically.

The Postfix mail server listening on this port appears vulnerable to a memory corruption attack as Nessus was able to crash an SMTP session with this host by using two different authentication methods in one session. 

Note that code execution as the unprivileged postfix user may also be possible.

According to its banner, the version of the Postfix mail server listening on this port is earlier than 2.5.13, 2.6.19, 2.7.4, or 2.8.3.  Such versions may be vulnerable to a memory corruption attack if they have Cyrus SASL enabled and are allowing authentication methods other than ANONYMOUS, LOGIN, and PLAIN.  Code execution as the unprivileged postfix user may also be possible. 

Note that Nessus did not test whether the remote server was using Cyrus specifically, as opposed to another SASL library such as Dovecot.

A vulnerability has been found and corrected in postfix :

The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method (CVE-2011-1720).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

The following bugs have been fixed :

  - Remote attackers could potentially exploit a memory     corruption issue in postfix' SASL implementation to     execute arbitrary code. (CVE-2011-1720)

  - Also Postfix did not clear the receive buffer after the     STARTTLS command. A man-in-the middle could therefore     inject commands in the unencrypted stream that get     interpreted in the encrypted phase after STARTTLS.
    (CVE-2011-0411)

Several vulnerabilities were discovered in Postfix, a mail transfer agent. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2939     The postinst script grants the postfix user write access     to /var/spool/postfix/pid, which might allow local users     to conduct symlink attacks that overwrite arbitrary     files.

  - CVE-2011-0411     The STARTTLS implementation does not properly restrict     I/O buffering, which allows man-in-the-middle attackers     to insert commands into encrypted SMTP sessions by     sending a cleartext command that is processed after TLS     is in place.

  - CVE-2011-1720     A heap-based read-only buffer overflow allows malicious     clients to crash the smtpd server process using a     crafted SASL authentication request.

The Postfix SMTP server has a memory corruption error, when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN (ANONYMOUS is not affected, but should not be used for other reasons). This memory corruption is known to result in a program crash (SIGSEV).

ID	Name	Product	Family	Severity
75997	openSUSE Security Update : postfix (openSUSE-SU-2011:0476-1)	Nessus	SuSE Local Security Checks	medium
75711	openSUSE Security Update : postfix (openSUSE-SU-2011:0476-1)	Nessus	SuSE Local Security Checks	medium
68283	Oracle Linux 5 / 6 : post (ELSA-2011-0843)	Nessus	Oracle Linux Local Security Checks	critical
61060	Scientific Linux Security Update : postfix on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59706	GLSA-201206-33 : Postfix: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
57243	SuSE 10 Security Update : postfix (ZYPP Patch Number 7502)	Nessus	SuSE Local Security Checks	medium
55092	Ubuntu 6.06 LTS / 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : postfix vulnerability (USN-1131-1)	Nessus	Ubuntu Local Security Checks	medium
54937	CentOS 4 / 5 : postfix (CESA-2011:0843)	Nessus	CentOS Local Security Checks	medium
54931	RHEL 4 / 5 / 6 : postfix (RHSA-2011:0843)	Nessus	Red Hat Local Security Checks	medium
54584	Postfix Cyrus SASL Authentication Context Data Reuse Memory Corruption (exploit)	Nessus	SMTP problems	medium
54583	Postfix Cyrus SASL Authentication Context Data Reuse Memory Corruption	Nessus	SMTP problems	medium
54298	Mandriva Linux Security Advisory : postfix (MDVSA-2011:090)	Nessus	Mandriva Local Security Checks	medium
53875	openSUSE Security Update : postfix (openSUSE-SU-2011:0476-1)	Nessus	SuSE Local Security Checks	medium
53868	SuSE9 Security Update : Postfix (YOU Patch Number 12707)	Nessus	SuSE Local Security Checks	medium
53860	Debian DSA-2233-1 : postfix - several vulnerabilities	Nessus	Debian Local Security Checks	medium
53855	SuSE 10 Security Update : postfix (ZYPP Patch Number 7503)	Nessus	SuSE Local Security Checks	medium
53854	SuSE 11.1 Security Update : postfix (SAT Patch Number 4478)	Nessus	SuSE Local Security Checks	medium
53852	FreeBSD : Postfix -- memory corruption vulnerability (3eb2c100-738b-11e0-89f4-001e90d46635)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-1720

critical

Tenable Plugins

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium