CVE-2011-1720: Buffer Overflow
A heap-based buffer overread flaw was found in the way Postfix mail transport agent performed SASL handlers management for SMTP sessions, when the Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause Postfix smtpd server crash via specially-crafted SASL authentication request.
Note: The default configuration of Postfix mail transport agent, as shipped with Red Hat Enterprise Linux 4, 5, and 6 do not enable SASL support for SMTP authentication for mail clients (thus Postfix server instances using it are not vulnerable to this flaw).
Workaround: If your Postfix server configuration contains directive like:
smtpdsaslauthenable = yes
change 'yes' to 'no' or comment the whole line out not to be vulnerable to this flaw.
Other sources
The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1720?
CVE-2011-1720 is considered a medium severity vulnerability due to the potential for remote attackers to crash the Postfix server.
How do I fix CVE-2011-1720?
To mitigate CVE-2011-1720, upgrade Postfix to a version higher than 2.2.10-1.5.el4, 2.3.3-2.3.el5_6, or 2.6.6-2.2.el6_1.
Who is affected by CVE-2011-1720?
CVE-2011-1720 affects Postfix mail transport agent versions including those mentioned in Red Hat's announcements.
What types of attacks can exploit CVE-2011-1720?
CVE-2011-1720 can be exploited by a remote attacker sending specially crafted SASL authentication data, leading to a server crash.
Is there a patch available for CVE-2011-1720?
Yes, patches for CVE-2011-1720 are available in the newer versions of Postfix as indicated in the vulnerability announcement.