-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2011:090 http://www.mandriva.com/security/ _______________________________________________________________________ Package : postfix Date : May 17, 2011 Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in postfix: The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method (CVE-2011-1720). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1720 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.0: 1326a3c6e48e45049fb8f024a92e9327 2009.0/i586/libpostfix1-2.5.5-4.3mdv2009.0.i586.rpm db9f9583fe600220a4c3b88e380405a5 2009.0/i586/postfix-2.5.5-4.3mdv2009.0.i586.rpm 5b56b55f7bd99c75e63ace3f30563d96 2009.0/i586/postfix-ldap-2.5.5-4.3mdv2009.0.i586.rpm 10427140a4a15a36830829f58b303f62 2009.0/i586/postfix-mysql-2.5.5-4.3mdv2009.0.i586.rpm 98e66e07460821307d2f70dd4800c838 2009.0/i586/postfix-pcre-2.5.5-4.3mdv2009.0.i586.rpm aa53192429b7aed8d4289b51ec4cb09b 2009.0/i586/postfix-pgsql-2.5.5-4.3mdv2009.0.i586.rpm 4694f8539dc6c78b5883364643684771 2009.0/SRPMS/postfix-2.5.5-4.3mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: f83ba1b1f9db1a605fef6ac14ace9c11 2009.0/x86_64/lib64postfix1-2.5.5-4.3mdv2009.0.x86_64.rpm b34609798fe6ec9afbf7df1b404ebfd9 2009.0/x86_64/postfix-2.5.5-4.3mdv2009.0.x86_64.rpm aa2faee590701df2c52c0c0a397fd328 2009.0/x86_64/postfix-ldap-2.5.5-4.3mdv2009.0.x86_64.rpm cec328a0b6fa68067f7a9d0ac93754e4 2009.0/x86_64/postfix-mysql-2.5.5-4.3mdv2009.0.x86_64.rpm 64934922bb7cbd1601f86b33d9ebb47c 2009.0/x86_64/postfix-pcre-2.5.5-4.3mdv2009.0.x86_64.rpm 0f615e0db5b697f14cbb365fbf08e257 2009.0/x86_64/postfix-pgsql-2.5.5-4.3mdv2009.0.x86_64.rpm 4694f8539dc6c78b5883364643684771 2009.0/SRPMS/postfix-2.5.5-4.3mdv2009.0.src.rpm Mandriva Linux 2010.1: 5d798d385bbef67b5a9f944656fe8fff 2010.1/i586/libpostfix1-2.7.0-4.2mdv2010.2.i586.rpm 9145ded79bd413536a3cea86c9e71b9f 2010.1/i586/postfix-2.7.0-4.2mdv2010.2.i586.rpm b8dd8213dc4db210faf214cb4c456b2d 2010.1/i586/postfix-cdb-2.7.0-4.2mdv2010.2.i586.rpm 92c28b8d45d4db5489b6e710959cacc3 2010.1/i586/postfix-ldap-2.7.0-4.2mdv2010.2.i586.rpm fe5368cbe79376d793145901804d1092 2010.1/i586/postfix-mysql-2.7.0-4.2mdv2010.2.i586.rpm b3e62b3f5a8515b93eb7b5536a52f5fe 2010.1/i586/postfix-pcre-2.7.0-4.2mdv2010.2.i586.rpm a7ad1ed4b0307ae6260da4c2b9d822e8 2010.1/i586/postfix-pgsql-2.7.0-4.2mdv2010.2.i586.rpm 4681d51e9652432cfebbfd1bf2adcdd6 2010.1/SRPMS/postfix-2.7.0-4.2mdv2010.2.src.rpm Mandriva Linux 2010.1/X86_64: f42fbb3f8144f31f2eba7eabbe6d8ad5 2010.1/x86_64/lib64postfix1-2.7.0-4.2mdv2010.2.x86_64.rpm 7c92c86b7b4f975541e3f68afb2e2cf9 2010.1/x86_64/postfix-2.7.0-4.2mdv2010.2.x86_64.rpm 73a46012559559677e38508107c2f21a 2010.1/x86_64/postfix-cdb-2.7.0-4.2mdv2010.2.x86_64.rpm f1f12686d4f173f586d7d12014c34cbd 2010.1/x86_64/postfix-ldap-2.7.0-4.2mdv2010.2.x86_64.rpm 5e56411242773b0253f94cedc9feff42 2010.1/x86_64/postfix-mysql-2.7.0-4.2mdv2010.2.x86_64.rpm 8d23a994589f508b4e602d8038d217cf 2010.1/x86_64/postfix-pcre-2.7.0-4.2mdv2010.2.x86_64.rpm 17b5cb9a10eeb4159d4d490e949bb425 2010.1/x86_64/postfix-pgsql-2.7.0-4.2mdv2010.2.x86_64.rpm 4681d51e9652432cfebbfd1bf2adcdd6 2010.1/SRPMS/postfix-2.7.0-4.2mdv2010.2.src.rpm Corporate 4.0: c536b52f1378cb4a55971d82454d262b corporate/4.0/i586/libpostfix1-2.3.5-0.5.20060mlcs4.i586.rpm 02f8482473caae37dfae8cb968edaaa3 corporate/4.0/i586/postfix-2.3.5-0.5.20060mlcs4.i586.rpm 39122dc26c31878a108cf72a87c12991 corporate/4.0/i586/postfix-ldap-2.3.5-0.5.20060mlcs4.i586.rpm d6fed1d55e5b2d2c90cb648cc22931e1 corporate/4.0/i586/postfix-mysql-2.3.5-0.5.20060mlcs4.i586.rpm 23b476ccb4b5200b21d3dc7bcb1e6914 corporate/4.0/i586/postfix-pcre-2.3.5-0.5.20060mlcs4.i586.rpm 8c8df6325509f7caa9268775a419c378 corporate/4.0/i586/postfix-pgsql-2.3.5-0.5.20060mlcs4.i586.rpm e3379355ff572716b5b9bf2164df418d corporate/4.0/SRPMS/postfix-2.3.5-0.5.20060mlcs4.src.rpm Corporate 4.0/X86_64: 7a1c56854f3030fcc78d34810764057c corporate/4.0/x86_64/lib64postfix1-2.3.5-0.5.20060mlcs4.x86_64.rpm 64d01272c055acc5268aa12ff0f8a10b corporate/4.0/x86_64/postfix-2.3.5-0.5.20060mlcs4.x86_64.rpm 00a4250ce0d4c56c85387dcca95fa19b corporate/4.0/x86_64/postfix-ldap-2.3.5-0.5.20060mlcs4.x86_64.rpm 04cca803fb70f5be040020d3d4681012 corporate/4.0/x86_64/postfix-mysql-2.3.5-0.5.20060mlcs4.x86_64.rpm ed0b8a4b2f760e276682f6f7cc95099d corporate/4.0/x86_64/postfix-pcre-2.3.5-0.5.20060mlcs4.x86_64.rpm 37c324de6183e06b7f60794067be77b2 corporate/4.0/x86_64/postfix-pgsql-2.3.5-0.5.20060mlcs4.x86_64.rpm e3379355ff572716b5b9bf2164df418d corporate/4.0/SRPMS/postfix-2.3.5-0.5.20060mlcs4.src.rpm Mandriva Enterprise Server 5: 11f008ad8c89ab4e640a3235649b64db mes5/i586/libpostfix1-2.5.5-4.3mdvmes5.2.i586.rpm b6dee4eeaa6529d6c19e064073ca4bfd mes5/i586/postfix-2.5.5-4.3mdvmes5.2.i586.rpm b629d951af5c059bec8b922f3d48de8b mes5/i586/postfix-ldap-2.5.5-4.3mdvmes5.2.i586.rpm 4e23142fa8be0fe036024b6721b86872 mes5/i586/postfix-mysql-2.5.5-4.3mdvmes5.2.i586.rpm e51571f2e700148d3bb75ee9236c66ba mes5/i586/postfix-pcre-2.5.5-4.3mdvmes5.2.i586.rpm ccf639ecbcd748e41af6c18fcb83a138 mes5/i586/postfix-pgsql-2.5.5-4.3mdvmes5.2.i586.rpm 729ac6d22b6fd88f3aafa16695463e3b mes5/SRPMS/postfix-2.5.5-4.3mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 752c0e249967550d1caa6e81ec755baa mes5/x86_64/lib64postfix1-2.5.5-4.3mdvmes5.2.x86_64.rpm 46aa5ec4e7bf18bcac028599294445d4 mes5/x86_64/postfix-2.5.5-4.3mdvmes5.2.x86_64.rpm 2f4cf634db305c1dda1a2ac278861ee8 mes5/x86_64/postfix-ldap-2.5.5-4.3mdvmes5.2.x86_64.rpm 959b62c6e4d198768d29bfc92540859e mes5/x86_64/postfix-mysql-2.5.5-4.3mdvmes5.2.x86_64.rpm 9e80f154a3a83c1c1585bb70c1657332 mes5/x86_64/postfix-pcre-2.5.5-4.3mdvmes5.2.x86_64.rpm 738de86208f0979e091c24352ca4d818 mes5/x86_64/postfix-pgsql-2.5.5-4.3mdvmes5.2.x86_64.rpm 729ac6d22b6fd88f3aafa16695463e3b mes5/SRPMS/postfix-2.5.5-4.3mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFN0hVQmqjQ0CJFipgRAjEiAJ9C7+ACDr+I/i2Bm2NEfX34ujnsQgCdG++J 51W121JEcyzHEWKojcS07Go= =EwJq -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/