ID de Prueba:	1.3.6.1.4.1.25623.1.0.51451
Categoría:	Conectiva Local Security Checks
Título:	Conectiva Security Advisory CLA-2003:717
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory CLA-2003:717. Postfix[1] is a widely used MTA (Mail Transport Agent, sometimes called just an email or SMTP server). This update for Conectiva Linux 7.0 and 8 fixes two vulnerabilities in Postfix reported[4] by Michal Zalewski: 1. Postfix used as a bounce scanner (CVE-2003-0468)[2] By using specially created recipients, it is possible to make Postfix attempt to establish SMTP sessions with arbitrary hosts on arbitrary ports. This could be used to identify open TCP ports on remote machines or to just generate traffic. 2. Remote denial of service (CVE-2003-0540)[3] A malformed address can be used to cause a denial of service condition in two ways: - by locking up the queue manager: the offending message has to be manually removed from the queue in order to restore the service - by locking up the smtpd listener: when supplied with the malformed address, the listener process will stop responding. Multiple attacks in parallel will hang many smtpd processes, leading to a denial of service. In order to be vulnerable to this issue, the append_dot_mydomain paramater would have to be changed from the default value of on to off. Conectiva Linux 9 is not vulnerable to any of these issues since it ships with Postfix 2.0.x. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.postfix.org/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0468 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0540 http://www.securityfocus.com/archive/1/331713/2003-08-01/2003-08-07/0 https://secure1.securityspace.com/smysecure/catid.html?in=CLA-2003:717 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : Medium CVSS Score: 5.0
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0468 BugTraq ID: 8333 http://www.securityfocus.com/bid/8333 Bugtraq: 20030804 Postfix 1.1.12 remote DoS / Postfix 1.1.11 bounce scanning (Google Search) http://marc.info/?l=bugtraq&m=106001525130257&w=2 Conectiva Linux advisory: CLA-2003:717 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717 Debian Security Information: DSA-363 (Google Search) http://www.debian.org/security/2003/dsa-363 http://www.mandriva.com/security/advisories?name=MDKSA-2003:081 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A522 http://www.redhat.com/support/errata/RHSA-2003-251.html http://secunia.com/advisories/9433 SuSE Security Announcement: SuSE-SA:2003:033 (Google Search) http://www.novell.com/linux/security/advisories/2003_033_postfix.html Common Vulnerability Exposure (CVE) ID: CVE-2003-0540 CERT/CC vulnerability note: VU#895508 http://www.kb.cert.org/vuls/id/895508 En Garde Linux Advisory: ESA-20030804-019 http://www.linuxsecurity.com/advisories/engarde_advisory-3517.html http://lists.grok.org.uk/pipermail/full-disclosure/2003-August/007693.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A544 http://marc.info/?l=bugtraq&m=106029188614704&w=2
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.