lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list] 
Message-Id: <E1QMGxZ-0002m5-9f@titan.mandriva.com>
Date: Tue, 17 May 2011 11:53:01 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2011:090 ] postfix

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:090
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : postfix
 Date    : May 17, 2011
 Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in postfix:
 
 The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10,
 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL
 authentication methods are enabled, does not create a new server handle
 after client authentication fails, which allows remote attackers to
 cause a denial of service (heap memory corruption and daemon crash)
 or possibly execute arbitrary code via an invalid AUTH command
 with one method followed by an AUTH command with a different method
 (CVE-2011-1720).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1720
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 1326a3c6e48e45049fb8f024a92e9327  2009.0/i586/libpostfix1-2.5.5-4.3mdv2009.0.i586.rpm
 db9f9583fe600220a4c3b88e380405a5  2009.0/i586/postfix-2.5.5-4.3mdv2009.0.i586.rpm
 5b56b55f7bd99c75e63ace3f30563d96  2009.0/i586/postfix-ldap-2.5.5-4.3mdv2009.0.i586.rpm
 10427140a4a15a36830829f58b303f62  2009.0/i586/postfix-mysql-2.5.5-4.3mdv2009.0.i586.rpm
 98e66e07460821307d2f70dd4800c838  2009.0/i586/postfix-pcre-2.5.5-4.3mdv2009.0.i586.rpm
 aa53192429b7aed8d4289b51ec4cb09b  2009.0/i586/postfix-pgsql-2.5.5-4.3mdv2009.0.i586.rpm 
 4694f8539dc6c78b5883364643684771  2009.0/SRPMS/postfix-2.5.5-4.3mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 f83ba1b1f9db1a605fef6ac14ace9c11  2009.0/x86_64/lib64postfix1-2.5.5-4.3mdv2009.0.x86_64.rpm
 b34609798fe6ec9afbf7df1b404ebfd9  2009.0/x86_64/postfix-2.5.5-4.3mdv2009.0.x86_64.rpm
 aa2faee590701df2c52c0c0a397fd328  2009.0/x86_64/postfix-ldap-2.5.5-4.3mdv2009.0.x86_64.rpm
 cec328a0b6fa68067f7a9d0ac93754e4  2009.0/x86_64/postfix-mysql-2.5.5-4.3mdv2009.0.x86_64.rpm
 64934922bb7cbd1601f86b33d9ebb47c  2009.0/x86_64/postfix-pcre-2.5.5-4.3mdv2009.0.x86_64.rpm
 0f615e0db5b697f14cbb365fbf08e257  2009.0/x86_64/postfix-pgsql-2.5.5-4.3mdv2009.0.x86_64.rpm 
 4694f8539dc6c78b5883364643684771  2009.0/SRPMS/postfix-2.5.5-4.3mdv2009.0.src.rpm

 Mandriva Linux 2010.1:
 5d798d385bbef67b5a9f944656fe8fff  2010.1/i586/libpostfix1-2.7.0-4.2mdv2010.2.i586.rpm
 9145ded79bd413536a3cea86c9e71b9f  2010.1/i586/postfix-2.7.0-4.2mdv2010.2.i586.rpm
 b8dd8213dc4db210faf214cb4c456b2d  2010.1/i586/postfix-cdb-2.7.0-4.2mdv2010.2.i586.rpm
 92c28b8d45d4db5489b6e710959cacc3  2010.1/i586/postfix-ldap-2.7.0-4.2mdv2010.2.i586.rpm
 fe5368cbe79376d793145901804d1092  2010.1/i586/postfix-mysql-2.7.0-4.2mdv2010.2.i586.rpm
 b3e62b3f5a8515b93eb7b5536a52f5fe  2010.1/i586/postfix-pcre-2.7.0-4.2mdv2010.2.i586.rpm
 a7ad1ed4b0307ae6260da4c2b9d822e8  2010.1/i586/postfix-pgsql-2.7.0-4.2mdv2010.2.i586.rpm 
 4681d51e9652432cfebbfd1bf2adcdd6  2010.1/SRPMS/postfix-2.7.0-4.2mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 f42fbb3f8144f31f2eba7eabbe6d8ad5  2010.1/x86_64/lib64postfix1-2.7.0-4.2mdv2010.2.x86_64.rpm
 7c92c86b7b4f975541e3f68afb2e2cf9  2010.1/x86_64/postfix-2.7.0-4.2mdv2010.2.x86_64.rpm
 73a46012559559677e38508107c2f21a  2010.1/x86_64/postfix-cdb-2.7.0-4.2mdv2010.2.x86_64.rpm
 f1f12686d4f173f586d7d12014c34cbd  2010.1/x86_64/postfix-ldap-2.7.0-4.2mdv2010.2.x86_64.rpm
 5e56411242773b0253f94cedc9feff42  2010.1/x86_64/postfix-mysql-2.7.0-4.2mdv2010.2.x86_64.rpm
 8d23a994589f508b4e602d8038d217cf  2010.1/x86_64/postfix-pcre-2.7.0-4.2mdv2010.2.x86_64.rpm
 17b5cb9a10eeb4159d4d490e949bb425  2010.1/x86_64/postfix-pgsql-2.7.0-4.2mdv2010.2.x86_64.rpm 
 4681d51e9652432cfebbfd1bf2adcdd6  2010.1/SRPMS/postfix-2.7.0-4.2mdv2010.2.src.rpm

 Corporate 4.0:
 c536b52f1378cb4a55971d82454d262b  corporate/4.0/i586/libpostfix1-2.3.5-0.5.20060mlcs4.i586.rpm
 02f8482473caae37dfae8cb968edaaa3  corporate/4.0/i586/postfix-2.3.5-0.5.20060mlcs4.i586.rpm
 39122dc26c31878a108cf72a87c12991  corporate/4.0/i586/postfix-ldap-2.3.5-0.5.20060mlcs4.i586.rpm
 d6fed1d55e5b2d2c90cb648cc22931e1  corporate/4.0/i586/postfix-mysql-2.3.5-0.5.20060mlcs4.i586.rpm
 23b476ccb4b5200b21d3dc7bcb1e6914  corporate/4.0/i586/postfix-pcre-2.3.5-0.5.20060mlcs4.i586.rpm
 8c8df6325509f7caa9268775a419c378  corporate/4.0/i586/postfix-pgsql-2.3.5-0.5.20060mlcs4.i586.rpm 
 e3379355ff572716b5b9bf2164df418d  corporate/4.0/SRPMS/postfix-2.3.5-0.5.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 7a1c56854f3030fcc78d34810764057c  corporate/4.0/x86_64/lib64postfix1-2.3.5-0.5.20060mlcs4.x86_64.rpm
 64d01272c055acc5268aa12ff0f8a10b  corporate/4.0/x86_64/postfix-2.3.5-0.5.20060mlcs4.x86_64.rpm
 00a4250ce0d4c56c85387dcca95fa19b  corporate/4.0/x86_64/postfix-ldap-2.3.5-0.5.20060mlcs4.x86_64.rpm
 04cca803fb70f5be040020d3d4681012  corporate/4.0/x86_64/postfix-mysql-2.3.5-0.5.20060mlcs4.x86_64.rpm
 ed0b8a4b2f760e276682f6f7cc95099d  corporate/4.0/x86_64/postfix-pcre-2.3.5-0.5.20060mlcs4.x86_64.rpm
 37c324de6183e06b7f60794067be77b2  corporate/4.0/x86_64/postfix-pgsql-2.3.5-0.5.20060mlcs4.x86_64.rpm 
 e3379355ff572716b5b9bf2164df418d  corporate/4.0/SRPMS/postfix-2.3.5-0.5.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 11f008ad8c89ab4e640a3235649b64db  mes5/i586/libpostfix1-2.5.5-4.3mdvmes5.2.i586.rpm
 b6dee4eeaa6529d6c19e064073ca4bfd  mes5/i586/postfix-2.5.5-4.3mdvmes5.2.i586.rpm
 b629d951af5c059bec8b922f3d48de8b  mes5/i586/postfix-ldap-2.5.5-4.3mdvmes5.2.i586.rpm
 4e23142fa8be0fe036024b6721b86872  mes5/i586/postfix-mysql-2.5.5-4.3mdvmes5.2.i586.rpm
 e51571f2e700148d3bb75ee9236c66ba  mes5/i586/postfix-pcre-2.5.5-4.3mdvmes5.2.i586.rpm
 ccf639ecbcd748e41af6c18fcb83a138  mes5/i586/postfix-pgsql-2.5.5-4.3mdvmes5.2.i586.rpm 
 729ac6d22b6fd88f3aafa16695463e3b  mes5/SRPMS/postfix-2.5.5-4.3mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 752c0e249967550d1caa6e81ec755baa  mes5/x86_64/lib64postfix1-2.5.5-4.3mdvmes5.2.x86_64.rpm
 46aa5ec4e7bf18bcac028599294445d4  mes5/x86_64/postfix-2.5.5-4.3mdvmes5.2.x86_64.rpm
 2f4cf634db305c1dda1a2ac278861ee8  mes5/x86_64/postfix-ldap-2.5.5-4.3mdvmes5.2.x86_64.rpm
 959b62c6e4d198768d29bfc92540859e  mes5/x86_64/postfix-mysql-2.5.5-4.3mdvmes5.2.x86_64.rpm
 9e80f154a3a83c1c1585bb70c1657332  mes5/x86_64/postfix-pcre-2.5.5-4.3mdvmes5.2.x86_64.rpm
 738de86208f0979e091c24352ca4d818  mes5/x86_64/postfix-pgsql-2.5.5-4.3mdvmes5.2.x86_64.rpm 
 729ac6d22b6fd88f3aafa16695463e3b  mes5/SRPMS/postfix-2.5.5-4.3mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFN0hVQmqjQ0CJFipgRAjEiAJ9C7+ACDr+I/i2Bm2NEfX34ujnsQgCdG++J
51W121JEcyzHEWKojcS07Go=
=EwJq
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ