Ubuntu 11.04: USN-1132-1 Severe Postfix Service Interruption

ubuntu

May 11, 2011

An attacker could send crafted input to Postfix and cause it to crash or run programs.

Summary

An attacker could send crafted input to Postfix and cause it to crash or

run programs.

Software Description:

- postfix: High-performance mail transport agent

Details:

Thomas Jarosch discovered that Postfix incorrectly handled authentication

mechanisms other than PLAIN and LOGIN when the Cyrus SASL library is used.

A remote attacker could use this to cause Postfix to crash, leading to a

denial of service, or possibly execute arbitrary code as the postfix user.

Topics Covered

security advisory denial of service critical Ubuntu Postfix

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  postfix                         2.8.2-1ubuntu2.1

Ubuntu 10.10:
  postfix                         2.7.1-1ubuntu0.2

Ubuntu 10.04 LTS:
  postfix                         2.7.0-1ubuntu0.2

Ubuntu 8.04 LTS:
  postfix                         2.5.1-2ubuntu1.4

Ubuntu 6.06 LTS:
  postfix                         2.2.10-1ubuntu0.4

In general, a standard system update will make all the necessary changes.