CVE-2011-1720

Postfix <2.5.13, 2.6.x <2.6.10, 2.7.x <2.7.4, 2.8.x <2.8.3 - DoS

Title source: llm
STIX 2.1

Description

The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.

References (18)

Core 18
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/517917/100/0/threaded
Vendor Advisory x_refsource_confirm
http://www.postfix.org/CVE-2011-1720.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/44500
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/47778
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201206-33.xml
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/72259
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/727230
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1025521
Vendor Advisory x_refsource_confirm
http://www.postfix.org/announcements/postfix-2.8.3.html
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/8247
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=699035
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:090
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2233
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-1131-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/67359

Scores

EPSS 0.2165
EPSS Percentile 97.3%

Details

CWE
CWE-119
Status published
Products (50)
postfix/postfix 2.0.0
postfix/postfix 2.0.1
postfix/postfix 2.0.2
postfix/postfix 2.0.3
postfix/postfix 2.0.4
postfix/postfix 2.0.5
postfix/postfix 2.0.6
postfix/postfix 2.0.7
postfix/postfix 2.0.8
postfix/postfix 2.0.9
... and 40 more
Published May 13, 2011
Tracked Since Feb 18, 2026