REDHAT-BUG-699035
First published: Fri Apr 22 2011(Updated: )
A heap-based buffer overread flaw was found in the way Postfix mail transport agent performed SASL handlers management for SMTP sessions, when the Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause Postfix smtpd server crash via specially-crafted SASL authentication request. Note: The default configuration of Postfix mail transport agent, as shipped with Red Hat Enterprise Linux 4, 5, and 6 do not enable SASL support for SMTP authentication for mail clients (thus Postfix server instances using it are not vulnerable to this flaw). Workaround: If your Postfix server configuration contains directive like: smtpd_sasl_auth_enable = yes change 'yes' to 'no' or comment the whole line out not to be vulnerable to this flaw.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Plone |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-699035?
The severity of REDHAT-BUG-699035 is considered moderate due to its potential for causing service disruption.
How do I fix REDHAT-BUG-699035?
Fix REDHAT-BUG-699035 by updating Postfix to the latest version that addresses the heap-based buffer overread flaw.
What software is affected by REDHAT-BUG-699035?
REDHAT-BUG-699035 affects the Postfix mail transport agent when Cyrus SASL authentication is enabled.
What type of vulnerability is REDHAT-BUG-699035?
REDHAT-BUG-699035 is classified as a heap-based buffer overread vulnerability.
Can REDHAT-BUG-699035 be exploited remotely?
Yes, a remote attacker can exploit REDHAT-BUG-699035 to crash the Postfix smtpd server.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1720
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/postfix
- canonical/plone