Obsolete NSA exploit for Postfix 2.0 - 2.2

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Obsolete NSA exploit for Postfix 2.0 - 2.2

Wietse Venema
A recent twitter post reveals the existence of an exploit for Postfix,
in a collection of what appear to be NSA tools.

https://twitter.com/JulianAssange/status/850870683831648256

This is an exploit for Postfix 2.0 - 2.2, for a bug that was fixed
11 years ago in Postfix 2.2.11 and later.

There was a memory corruption bug in a Postfix workaround for a
Sendmail bug (CERT advisory CA-2003-07, remote buffer overflow when
message headers contain lots of comment text before an email address).

Technical details: the Postfix strip_address() function, which
removes large comments from a mail header, called the printable()
function on a string that wasn't null-terminated. This caused the
printable() function to scribble past the end of malloc()ed memory,
corrupting the memory heap.

Running the exploit against Postfix versions less than 11 years old
results in odd-looking email messages in the super-user's mailbox,
and warning messages in the maillog file (warning: stripping too
many comments from address: <long character string>).

        Wietse
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Obsolete NSA exploit for Postfix 2.0 - 2.2

Viktor Dukhovni

> On Apr 9, 2017, at 4:18 PM, Wietse Venema <[hidden email]> wrote:
>
> This is an exploit for Postfix 2.0 - 2.2, for a bug that was fixed
> 11 years ago in Postfix 2.2.11 and later.

FWIW, the precise range is 2.0.6 through 2.2.10 inclusive.  First appeared
on 2003-03-05 in 2.0.6 (and snapshot 2.0.6-20030305 of the future 2.1) and
resolved on 2006-04-30 in 2.2.11 (and snapshot 2.3-20060430 of Postfix 2.3)

--
        Viktor.

Loading...