This is an exploit for Postfix 2.0 - 2.2, for a bug that was fixed
11 years ago in Postfix 2.2.11 and later.
There was a memory corruption bug in a Postfix workaround for a
Sendmail bug (CERT advisory CA-2003-07, remote buffer overflow when
message headers contain lots of comment text before an email address).
Technical details: the Postfix strip_address() function, which
removes large comments from a mail header, called the printable()
function on a string that wasn't null-terminated. This caused the
printable() function to scribble past the end of malloc()ed memory,
corrupting the memory heap.
Running the exploit against Postfix versions less than 11 years old
results in odd-looking email messages in the super-user's mailbox,
and warning messages in the maillog file (warning: stripping too
many comments from address: <long character string>).
> On Apr 9, 2017, at 4:18 PM, Wietse Venema <[hidden email]> wrote:
> This is an exploit for Postfix 2.0 - 2.2, for a bug that was fixed
> 11 years ago in Postfix 2.2.11 and later.
FWIW, the precise range is 2.0.6 through 2.2.10 inclusive. First appeared
on 2003-03-05 in 2.0.6 (and snapshot 2.0.6-20030305 of the future 2.1) and
resolved on 2006-04-30 in 2.2.11 (and snapshot 2.3-20060430 of Postfix 2.3)