SuSEConfig.postfix chroot Local DoS Attack Vulnerability
BID:3638
Info
SuSEConfig.postfix chroot Local DoS Attack Vulnerability
| Bugtraq ID: | 3638 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 04 2001 12:00AM |
| Updated: | Dec 04 2001 12:00AM |
| Credit: | Discovered by Matthias Andree <[email protected]> and posted to the BugTraq mailing list on December 4, 2001. |
| Vulnerable: |
S.u.S.E. SuSEConfig.postfix |
| Not Vulnerable: | |
Discussion
SuSEConfig.postfix chroot Local DoS Attack Vulnerability
SuSEConfig helps configure and reconfigure SuSE Linux systems. The SuSEConfig.postfix script is designed to set up the Postfix mail daemon, and includes the option to create a chroot environment for the Postfix processes. By default, the chroot directory is /var/spool/postfix.
Later in the script, a recursive chmod call sets all files within the /var/spool/postfix directory to be owned by the postfix user. This includes the /var/spool/postfix/maildrop/ directory, which is used by the Postfix sendmail compatibility program to insert local mail into the system. If this occurs after a message is created in this directory, but before it is rejected by the Postfix postdrop process, it will be impossible for postdrop to delete this message. As a result, disk space may be filled up by a local user, possibly leading to a DoS situation.
This is only a problem if Postfix is installed without a world writable maildrop directory, as described in the Postfix installation documentation.
SuSEConfig helps configure and reconfigure SuSE Linux systems. The SuSEConfig.postfix script is designed to set up the Postfix mail daemon, and includes the option to create a chroot environment for the Postfix processes. By default, the chroot directory is /var/spool/postfix.
Later in the script, a recursive chmod call sets all files within the /var/spool/postfix directory to be owned by the postfix user. This includes the /var/spool/postfix/maildrop/ directory, which is used by the Postfix sendmail compatibility program to insert local mail into the system. If this occurs after a message is created in this directory, but before it is rejected by the Postfix postdrop process, it will be impossible for postdrop to delete this message. As a result, disk space may be filled up by a local user, possibly leading to a DoS situation.
This is only a problem if Postfix is installed without a world writable maildrop directory, as described in the Postfix installation documentation.
Exploit / POC
SuSEConfig.postfix chroot Local DoS Attack Vulnerability
No exploit code is required to take advantage of this issue.
No exploit code is required to take advantage of this issue.
Solution / Fix
SuSEConfig.postfix chroot Local DoS Attack Vulnerability
Solution:
A modified SuSEConfig.postfix file has been made available by Matthias Andree, at:
http://mandree.home.pages.de/postfix/
Solution:
A modified SuSEConfig.postfix file has been made available by Matthias Andree, at:
http://mandree.home.pages.de/postfix/
References
SuSEConfig.postfix chroot Local DoS Attack Vulnerability
References:
References:
- Postfix Homepage (Wietse Venema)
- S.u.S.E. Homepage (S.u.S.E.)