Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: [USN-74-1] Postfix vulnerability
From: wietse () porcupine org (Wietse Venema)
Date: Sat, 5 Feb 2005 17:09:57 -0500 (EST)


This is a bug in a third-party IPv6 patch that is not part of Postfix.

Neither the official Postfix release, nor the work-in-progress
version are not affected by this.


Martin Pitt:
Jean-Samuel Reynaud noticed a programming error in the IPv6 handling
code of Postfix when /proc/net/if_inet6 is not available (which is the
case in Ubuntu since Postfix runs in a chroot). If "permit_mx_backup"
was enabled in the "smtpd_recipient_restrictions", Postfix turned into
an open relay, i. e. erroneously permitted the delivery of arbitrary
mail to any MX host which has an IPv6 address.
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]