Executive Summary

Summary
Title Postfix vulnerabilities
Informations
NameUSN-642-1First vendor Publication2008-09-10
VendorUbuntuLast vendor Modification2008-09-10
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score2.1Attack RangeLocal
Cvss Impact Score2.9Attack ComplexityLow
Cvss Expoit Score3.9AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 7.10
Ubuntu 8.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 7.10:
postfix 2.4.5-3ubuntu1.3

Ubuntu 8.04 LTS:
postfix 2.5.1-2ubuntu1.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Wietse Venema discovered that Postfix leaked internal file descriptors
when executing non-Postfix commands. A local attacker could exploit
this to cause Postfix to run out of descriptors, leading to a denial
of service.


Original Source

Url : http://www.ubuntu.com/usn/USN-642-1

CWE : Common Weakness Enumeration

idName
CWE-20Improper Input Validation

CPE : Common Platform Enumeration

TypeDescriptionCount
Application14

ExploitDB Exploits

idDescription
2008-09-16Postfix < 2.4.9, 2.5.5, 2.6-20080902 - (.forward) Local DoS Exploit

OpenVAS Exploits

DateDescription
2009-04-09Name : Mandriva Update for postfix MDVSA-2008:190 (postfix)
File : nvt/gb_mandriva_MDVSA_2008_190.nasl
2009-03-23Name : Ubuntu Update for postfix vulnerabilities USN-642-1
File : nvt/gb_ubuntu_USN_642_1.nasl
2009-02-17Name : Fedora Update for postfix FEDORA-2008-8593
File : nvt/gb_fedora_2008_8593_postfix_fc9.nasl
2009-02-17Name : Fedora Update for postfix FEDORA-2008-8595
File : nvt/gb_fedora_2008_8595_postfix_fc8.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200809-09 (postfix)
File : nvt/glsa_200809_09.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
48108Postfix epoll File Descriptor Leak Local DoS

Nessus® Vulnerability Scanner

DateDescription
2009-07-21Name : The remote SuSE system is missing a security patch for postfix
File : suse_11_0_postfix-080912.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-642-1.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-190.nasl - Type : ACT_GATHER_INFO
2008-10-10Name : The remote Fedora host is missing a security update.
File : fedora_2008-8593.nasl - Type : ACT_GATHER_INFO
2008-10-10Name : The remote Fedora host is missing a security update.
File : fedora_2008-8595.nasl - Type : ACT_GATHER_INFO
2008-10-06Name : The remote mail server is vulnerable to a local denial of service attack.
File : postfix_epoll_local_DoS.nasl - Type : ACT_GATHER_INFO
2008-09-22Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200809-09.nasl - Type : ACT_GATHER_INFO
2008-09-18Name : The remote SuSE system is missing the security patch postfix-5603
File : suse_postfix-5603.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 12:05:17
  • Multiple Updates