From owner-freebsd-questions@FreeBSD.ORG Wed Jun 16 20:32:50 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F08FB16A4CE for ; Wed, 16 Jun 2004 20:32:50 +0000 (GMT) Received: from mygirlfriday.info (user204.net795.mo.sprint-hsd.net [65.41.216.204]) by mx1.FreeBSD.org (Postfix) with SMTP id E676F43D46 for ; Wed, 16 Jun 2004 20:32:49 +0000 (GMT) (envelope-from gv-list-freebsdquestions@mygirlfriday.info) Received: (qmail 13225 invoked from network); 16 Jun 2004 20:32:48 -0000 Received: from unknown (HELO mork) (192.168.0.4) by mongo.mygirlfriday.info with SMTP; 16 Jun 2004 20:32:48 -0000 Date: Wed, 16 Jun 2004 15:32:48 -0500 From: Gary Organization: Hardly X-Priority: 3 (Normal) Message-ID: <786347175.20040616153248@mygirlfriday.info> To: Jim Trigg In-Reply-To: <20040616201347.GB29666@spamcop.net> References: <40D023A1.8090009@cs.uiowa.edu> <20040616140305.GD32001@millerlite.local.mark-and-erika.com> <20040616145305.GB15913@ei.bzerk.org> <40D081D1.1060606@mac.com> <16592.38955.399680.399710@jerusalem.litteratus.org> <20040616201347.GB29666@spamcop.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re[2]: Mail X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: freebsd-questions@freebsd.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jun 2004 20:32:51 -0000 Hi Jim, On Wed, 16 Jun 2004 16:13:47 -0400 UTC (6/16/2004, 3:13 PM -0500 UTC my time), Jim Trigg wrote: J> Postfix and Exim. I found no security advisories for either on the CERT J> website; that actually covers their entire lifecycles. Postfix: Actually IIRC, there were two, but could only find one in a short time of checking. Postfix versions before 1.1.12 allow an attacker to bounce-scan private networks, or use the daemon as a DDoS tool by forcing the daemon to connect to an arbitrary service at an arbitrary IP address and receiving either a bounce message or by analyzing timing. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0468 to this issue. Postfix versions from 1.1 up to and including 1.1.12 have a bug where a remote attacker could send a malformed envelope address and: also http://www.net-security.org/advisory.php?id=2327 EXIM http://www.guninski.com/exim1.html or http://www.icetalk.com/Exim-N2588.html same as http://secunia.com/advisories/11558/ and http://www.spinics.net/lists/security/msg01343.html -- Gary Chaos, panic, pandemonium - my work here is done.