CVEvulnerability

CVE-2011-1720

6.8 MEDIUM Published 2011-05-13 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-05-13
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-119

Description

The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.

Affected configurations

• postfix postfix 2.0.0 • postfix postfix 2.0.1 • postfix postfix 2.0.2 • postfix postfix 2.0.3 • postfix postfix 2.0.4 • postfix postfix 2.0.5 • postfix postfix 2.0.6 • postfix postfix 2.0.7 • postfix postfix 2.0.8 • postfix postfix 2.0.9 • postfix postfix 2.0.10 • postfix postfix 2.0.11 • postfix postfix 2.0.12 • postfix postfix 2.0.13 • postfix postfix 2.0.14 • postfix postfix 2.0.15 • postfix postfix 2.0.16 • postfix postfix 2.0.17 • postfix postfix 2.0.18 • postfix postfix 2.0.19 • postfix postfix 2.1.0 • postfix postfix 2.1.1 • postfix postfix 2.1.2 • postfix postfix 2.1.3 • postfix postfix 2.1.4 • postfix postfix 2.1.5 • postfix postfix 2.1.6 • postfix postfix 2.2.0 • postfix postfix 2.2.1 • postfix postfix 2.2.2 • postfix postfix 2.2.3 • postfix postfix 2.2.4 • postfix postfix 2.2.5 • postfix postfix 2.2.6 • postfix postfix 2.2.7 • postfix postfix 2.2.8 • postfix postfix 2.2.9 • postfix postfix 2.2.10 • postfix postfix 2.2.11 • postfix postfix 2.2.12 • postfix postfix 2.3 • postfix postfix 2.3.0 • postfix postfix 2.3.1 • postfix postfix 2.3.2 • postfix postfix 2.3.3 • postfix postfix 2.3.4 • postfix postfix 2.3.5 • postfix postfix 2.3.6 • postfix postfix 2.3.7 • postfix postfix 2.3.8 • postfix postfix 2.3.9 • postfix postfix 2.3.10 • postfix postfix 2.3.11 • postfix postfix 2.3.12 • postfix postfix 2.3.13 • postfix postfix 2.3.14 • postfix postfix 2.3.15 • postfix postfix 2.3.16 • postfix postfix 2.3.17 • postfix postfix 2.3.18 … and 49 more

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References