Pardus alert 2011-68 (postfix)

From:
    	     
 
Meltem Parmaksız <meltem@pardus.org.tr> 
To:
    	     
 
pardus-security@pardus.org.tr 
Subject:
    	     
 
[Pardus-security] [PLSA 2011-68] Postfix: Man In The Middle Attacks 
Date:
    	     
 
Tue, 3 May 2011 13:56:30 +0300
Message-ID:
    	     
 
<201105031356.31086.meltem@pardus.org.tr>
Archive-link:
    	     
 
Article, Thread
              
------------------------------------------------------------------------
Pardus Linux Security Advisory 2011-68            security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2011-04-07
      Type: Remote
------------------------------------------------------------------------

Summary
=======

A vulnerability has been fixed in postfix, which  allows  attackers  to 
perform man in the middle attacks (MITM). 


Description
===========

CVE-2011-0411: 

The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before
2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3  does  not  properly 
restrict I/O buffering, which  allows  man-in-the-middle  attackers  to 
insert commands into encrypted SMTP sessions  by  sending  a  cleartext 
command that is processed after TLS is in place, related to a "plaintext
command injection" attack. 


Affected packages:

  Pardus 2009:
    postfix, all before 2.6.9-25-6
  Pardus 2011:
    postfix, all before 2.7.3-28-p11


Resolution
==========

There are update(s) for postfix. You can update them via Package Manager
or with a single command from console: 

  Pardus 2009:
    pisi up postfix

  Pardus 2011:
    pisi up postfix


References
==========

  * http://bugs.pardus.org.tr/show_bug.cgi?id=17407
  * http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-...

------------------------------------------------------------------------
_______________________________________________
Pardus-Security mailing list
Pardus-Security@pardus.org.tr
http://liste.pardus.org.tr/mailman/listinfo/pardus-security