CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 6CVE-2023-51764 – postfix: SMTP smuggling vulnerability
https://notcve.org/view.php?id=CVE-2023-51764
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9. • https://github.com/duy-31/CVE-2023-51764 https://github.com/eeenvik1/CVE-2023-51764 https://github.com/Double-q1015/CVE-2023-51764 https://github.com/d4op/CVE-2023-51764-POC http://www.openwall.com/lists/oss-security/2023/12/24/1 http://www.openwall.com/lists/oss-security/2023/12/25/1 http://www.openwall.com/lists/oss-security/2024/05/09/3 https://access.redhat.com/security/cve/CVE-2023-51764 https://bugzilla.redhat.com/show_bug.cgi?id=2255563 http • CWE-345: Insufficient Verification of Data Authenticity CWE-451: User Interface (UI) Misrepresentation of Critical Information •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2017-10140 – libdb: Reads DB_CONFIG from the current working directory
https://notcve.org/view.php?id=CVE-2017-10140
Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory. Postfix, en versiones anteriores a la 2.11.10, versiones 3.0.x anteriores a la 3.0.10, versiones 3.1.x anteriores a la 3.1.6 y versiones 3.2.x anteriores a la 3.2.2, podría permitir que usuarios locales obtengan privilegios aprovechando una funcionalidad no documentada en Berkeley DB, en versiones 2.x y posteriores. Esto está relacionado con la lectura de opciones de DB_CONFIG en el directorio actual. • http://seclists.org/oss-sec/2017/q3/285 http://www.postfix.org/announcements/postfix-3.2.2.html https://access.redhat.com/errata/RHSA-2019:0366 https://www.oracle.com/security-alerts/cpujul2020.html https://access.redhat.com/security/cve/CVE-2017-10140 https://bugzilla.redhat.com/show_bug.cgi?id=1464032 •
CVSS: 6.8EPSS: 88%CPEs: 109EXPL: 0CVE-2011-1720 – (smtpd): Crash due to improper management of SASL handlers for SMTP sessions
https://notcve.org/view.php?id=CVE-2011-1720
The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method. El servidor SMTP en Postfix anterior a v2.5.13, v2.6.x anterior a v2.6.10, v2.7.x anterior a v2.7.4, y v2.8.x anterior a v2.8.3, cuando ciertos métodos Cyrus SASL de autenticación son activados, no crea un nuevo manejador de servidor después de que la autentificación falle, lo que permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria libre y caída de demonio) o posiblemente ejecutar código de su elección a tra´ves de un comando AUTH no válido con un método seguido por un comando AUTH con un método diferente. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00002.html http://secunia.com/advisories/44500 http://security.gentoo.org/glsa/glsa-201206-33.xml http://securityreason.com/securityalert/8247 http://www.debian.org/security/2011/dsa-2233 http://www.kb.cert.org/vuls/id/727230 http://www.mail-archive.com/postfix-announce%40postfix.org/msg00007.html http://www.mandriva.com/security/advisories?name=MDVSA-2011 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 1%CPEs: 42EXPL: 1CVE-2011-0411 – postfix: SMTP commands injection during plaintext to TLS session switch
https://notcve.org/view.php?id=CVE-2011-0411
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack. La implementación de STARTTLS de Postfix 2.4.x anteriores a 2.4.16, 2.5.x anteriores a 2.5.12, 2.6.x anteriores a 2.6.9, y 2.7.x anteriores a 2.7.3 no restringe apropiadamente el buffering de I/O, lo que permite a atacantes man-in-the-middle insertar comandos en sesiones SMTP encriptadas enviando un comando en texto claro que es procesado después de que TLS es iniciado. Relacionado con un ataque de "inyección de comandos de texto en claro". • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056559.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056560.html http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://secunia.com/advisories/43646 http://secunia.com/advisories/43874 http://security.gentoo.org/glsa/glsa-201206-33.xml h • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 1CVE-2008-4977
https://notcve.org/view.php?id=CVE-2008-4977
postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_groups.message temporary files. NOTE: the vendor disputes this vulnerability, stating "This is not a real issue ... users would have to edit a script under /usr/lib to enable it. ** CUESTIONADA ** postfix_groups.pl en Postfix v2.5.2 permite a usuarios locales sobrescribir ficheros a su elección a través de un ataque de enlace simulado en los ficheros temporales (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, y (3) /tmp/postfix_groups.message. NOTA: El vendedor ha impugnado esta vulnerabilidad, argumentando que "Este no es un problema real...los usuarios deberían realizar una secuencia de comandos bajo /usr/lib para poder hacerlo". • http://bugs.debian.org/496401 http://dev.gentoo.org/~rbu/security/debiantemp/postfix http://www.openwall.com/lists/oss-security/2008/10/30/2 https://bugs.gentoo.org/show_bug.cgi?id=235770 https://bugs.gentoo.org/show_bug.cgi?id=235811 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •