Apple Mac OS X Postfix Release SMTPD AUTH Username Denial Of Service Vulnerability
BID:11323
Info
Apple Mac OS X Postfix Release SMTPD AUTH Username Denial Of Service Vulnerability
| Bugtraq ID: | 11323 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2004-0925 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 04 2004 12:00AM |
| Updated: | Jul 12 2009 07:06AM |
| Credit: | Discovery is credited to Michael Rondinelli of EyeSee360. |
| Vulnerable: |
Wietse Venema Postfix 2.1 Wietse Venema Postfix 2.0 Wietse Venema Postfix 1.1.13 Wietse Venema Postfix 1.1.12 Wietse Venema Postfix 1.1.11 Wietse Venema Postfix 1.0.21 Wietse Venema Postfix 20011115 Wietse Venema Postfix 20010228 Wietse Venema Postfix 19991231 Wietse Venema Postfix 19990906 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X Postfix Release SMTPD AUTH Username Denial Of Service Vulnerability
A vulnerability exists in the Postfix release distributed with Mac OS X that is related to the handling of usernames supplied through SMTPD AUTH. This may potentially be exploited to deny certain users access to the server.
This condition may only occur if SMTPD AUTH has been enabled.
This issue reportedly does not affect the upstream release of Postfix but rather only the version distributed with Apple Mac OS X Panther.
A vulnerability exists in the Postfix release distributed with Mac OS X that is related to the handling of usernames supplied through SMTPD AUTH. This may potentially be exploited to deny certain users access to the server.
This condition may only occur if SMTPD AUTH has been enabled.
This issue reportedly does not affect the upstream release of Postfix but rather only the version distributed with Apple Mac OS X Panther.
Exploit / POC
Apple Mac OS X Postfix Release SMTPD AUTH Username Denial Of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Apple Mac OS X Postfix Release SMTPD AUTH Username Denial Of Service Vulnerability
Solution:
Apple has released updates for this issue that may be applied through Software Update. Manual updates are also available.
Apple Mac OS X Server 10.3.5
Apple Mac OS X 10.3.5
Solution:
Apple has released updates for this issue that may be applied through Software Update. Manual updates are also available.
Apple Mac OS X Server 10.3.5
-
Apple Security Update 2004-09-30 (Mac OS X 10.3.5 Client & Server)
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=04830&plat form=osx&method=sa/SecUpd2004-09-30Pan.dmg
Apple Mac OS X 10.3.5
-
Apple Security Update 2004-09-30 (Mac OS X 10.3.5 Client & Server)
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=04830&plat form=osx&method=sa/SecUpd2004-09-30Pan.dmg
References
Apple Mac OS X Postfix Release SMTPD AUTH Username Denial Of Service Vulnerability
References:
References:
- Postfix Homepage (Wietse Venema)