Published: 13/05/2011 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 710

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The SMTP server in Postfix prior to 2.5.13, 2.6.x prior to 2.6.10, 2.7.x prior to 2.7.4, and 2.8.x prior to 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote malicious users to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.

Vulnerable Product	Search on Vulmon	Subscribe to Product
postfix postfix 2.3.16
postfix postfix 2.3.18
postfix postfix 2.0.10
postfix postfix 2.4.10
postfix postfix 2.5.0
postfix postfix 2.4
postfix postfix 2.3.11
postfix postfix 2.0.14
postfix postfix 2.0.17
postfix postfix 2.2.7
postfix postfix 2.0.16
postfix postfix 2.3.6
postfix postfix 2.1.5
postfix postfix 2.5.9
postfix postfix 2.3.0
postfix postfix 2.0.6
postfix postfix 2.2.4
postfix postfix 2.0.15
postfix postfix 2.5.2
postfix postfix 2.4.15
postfix postfix 2.5.12
postfix postfix 2.4.0
postfix postfix 2.3.12
postfix postfix 2.3.10
postfix postfix 2.5.7
postfix postfix 2.5.8
postfix postfix 2.4.5
postfix postfix 2.1.4
postfix postfix 2.3.9
postfix postfix 2.3.2
postfix postfix 2.2.11
postfix postfix 2.3
postfix postfix 2.2.5
postfix postfix 2.3.7
postfix postfix 2.1.1
postfix postfix 2.3.14
postfix postfix 2.4.8
postfix postfix 2.4.12
postfix postfix 2.1.2
postfix postfix 2.4.3
postfix postfix 2.5.3
postfix postfix 2.2.3
postfix postfix 2.0.9
postfix postfix 2.0.4
postfix postfix 2.3.17
postfix postfix 2.5.10
postfix postfix 2.2.2
postfix postfix 2.0.0
postfix postfix 2.0.2
postfix postfix 2.0.11
postfix postfix 2.2.8
postfix postfix 2.4.11
postfix postfix 2.2.10
postfix postfix 2.3.19
postfix postfix 2.3.15
postfix postfix 2.4.7
postfix postfix 2.4.2
postfix postfix 2.0.1
postfix postfix 2.2.1
postfix postfix 2.0.12
postfix postfix 2.5.4
postfix postfix 2.5.11
postfix postfix 2.3.4
postfix postfix 2.4.9
postfix postfix 2.0.5
postfix postfix 2.3.3
postfix postfix 2.0.18
postfix postfix 2.0.13
postfix postfix 2.2.12
postfix postfix 2.3.1
postfix postfix 2.5.1
postfix postfix 2.0.3
postfix postfix 2.4.13
postfix postfix 2.0.7
postfix postfix 2.1.0
postfix postfix 2.3.8
postfix postfix 2.1.6
postfix postfix 2.4.14
postfix postfix 2.0.8
postfix postfix 2.3.5
postfix postfix 2.1.3
postfix postfix 2.5.5
postfix postfix 2.4.1
postfix postfix 2.0.19
postfix postfix 2.2.0
postfix postfix 2.4.6
postfix postfix 2.4.4
postfix postfix 2.2.6
postfix postfix 2.2.9
postfix postfix 2.5.6
postfix postfix 2.3.13
postfix postfix 2.6.9
postfix postfix 2.6.6
postfix postfix 2.6.3
postfix postfix 2.6.1
postfix postfix 2.6.7
postfix postfix 2.6.0
postfix postfix 2.6
postfix postfix 2.6.4
postfix postfix 2.6.5
postfix postfix 2.6.2
postfix postfix 2.6.8
postfix postfix 2.7.2
postfix postfix 2.7.0
postfix postfix 2.7.1
postfix postfix 2.7.3
postfix postfix 2.8.0
postfix postfix 2.8.1
postfix postfix 2.8.2

An attacker could send crafted input to Postfix and cause it to crash or run programs ...

Several vulnerabilities were discovered in Postfix, a mail transfer agent The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2939 The postinst script grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwr ...

Checks for a memory corruption in the Postfix SMTP server when it uses Cyrus SASL library authentication mechanisms (CVE-2011-1720). This vulnerability can allow denial of service and possibly remote code execution.

nmap --script=smtp-vuln-cve2011-1720 --script-args='smtp.domain=<domain>' -pT:25,465,587 <host>

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-vuln-cve2011-1720:
|   VULNERABLE:
|   Postfix SMTP server Cyrus SASL Memory Corruption
|     State: VULNERABLE
|     IDs:  CVE:CVE-2011-1720  OSVDB:72259
|     Description:
|       The Postfix SMTP server is vulnerable to a memory corruption vulnerability
|       when the Cyrus SASL library is used with authentication mechanisms other
|       than PLAIN and LOGIN.
|     Disclosure date: 2011-05-08
|     Check results:
|       AUTH tests: CRAM-MD5 NTLM
|     Extra information:
|       Available AUTH MECHANISMS:  CRAM-MD5 DIGEST-MD5 NTLM PLAIN LOGIN
|     References:
|       http://www.postfix.org/CVE-2011-1720.html
|       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1720
|_      http://osvdb.org/72259

Checks for a memory corruption in the Postfix SMTP server when it uses Cyrus SASL library authentication mechanisms (CVE-2011-1720). This vulnerability can allow denial of service and possibly remote code execution.

nmap --script=smtp-vuln-cve2011-1720 --script-args='smtp.domain=<domain>' -pT:25,465,587 <host>

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-vuln-cve2011-1720:
|   VULNERABLE:
|   Postfix SMTP server Cyrus SASL Memory Corruption
|     State: VULNERABLE
|     IDs:  CVE:CVE-2011-1720  BID:47778
|     Description:
|       The Postfix SMTP server is vulnerable to a memory corruption vulnerability
|       when the Cyrus SASL library is used with authentication mechanisms other
|       than PLAIN and LOGIN.
|     Disclosure date: 2011-05-08
|     Check results:
|       AUTH tests: CRAM-MD5 NTLM
|     Extra information:
|       Available AUTH MECHANISMS:  CRAM-MD5 DIGEST-MD5 NTLM PLAIN LOGIN
|     References:
|       http://www.postfix.org/CVE-2011-1720.html
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1720
|_      https://www.securityfocus.com/bid/47778

Scan d'énumération de cibles

Enums_Scan Des Scans d'énumération de cibles, ports et protocoles multiples en bash autoscan_nmap Ce script scanne un réseau ou une @IP nmap -p- --min-rate 1000 "$target" Cette partie de la commande utilise Nmap, un outil d'analyse réseau Il analyse un hôte cible à la recherche de ports ouverts Les options utilis&

CWE-119 http://www.kb.cert.org/vuls/id/727230 http://www.postfix.org/announcements/postfix-2.8.3.html https://bugzilla.redhat.com/show_bug.cgi?id=699035 http://secunia.com/advisories/44500 http://www.osvdb.org/72259 http://www.ubuntu.com/usn/usn-1131-1 http://www.postfix.org/CVE-2011-1720.html http://www.securityfocus.com/bid/47778 http://www.debian.org/security/2011/dsa-2233 http://www.securitytracker.com/id?1025521 http://www.mandriva.com/security/advisories?name=MDVSA-2011:090 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00002.html http://securityreason.com/securityalert/8247 http://security.gentoo.org/glsa/glsa-201206-33.xml http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 https://exchange.xforce.ibmcloud.com/vulnerabilities/67359 http://www.securityfocus.com/archive/1/517917/100/0/threaded http://www.mail-archive.com/postfix-announce%40postfix.org/msg00007.html https://usn.ubuntu.com/1131-1/https://nvd.nist.gov https://www.kb.cert.org/vuls/id/727230

CVE-2011-1720

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Nmap Scripts

Github Repositories

References

Vulmon Search

About

Products

Connect