Synopsis

postfix security update

Type/Severity

Security Advisory: Low

Topic

Updated postfix packages that include a security fix and two other bug
fixes are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat
Security Response Team

Description

Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL),
and TLS.

A flaw was found in the ipv6 patch used with Postfix. When the file
/proc/net/if_inet6 is not available and permit_mx_backup is enabled in
smtpd_recipient_restrictions, this flaw could allow remote attackers to
bypass e-mail restrictions and perform mail relaying by sending mail to an
IPv6 hostname. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0337 to this issue.

These updated packages also fix the following problems:

• wrong permissions on doc directory
  
• segfault when gethostbyname or gethostbyaddr fails
  

All users of postfix should upgrade to these updated packages, which
contain patches which resolve these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL
Certificate Errors, you need to install a version of the
up2date client with an updated certificate. The latest version of
up2date is available from the Red Hat FTP site and may also be
downloaded directly from the RHN website:

https://rhn.redhat.com/help/latest-up2date.pxt

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 139983 - newaliases segfaults when gethostbyname or gethostbyaddr fails
• BZ - 146732 - CAN-2005-0337 open relay bug in postfix ipv6 patch
• BZ - 147280 - Permissions on doc directory is wrong

CVEs

• CVE-2005-0337

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
postfix-2.1.5-4.2.RHEL4.src.rpm	SHA-256: 07d7e5f50a6195e5dbbc3e620aeb66ca5f0f45f27dd58db117881b9b18530f53
x86_64
postfix-2.1.5-4.2.RHEL4.x86_64.rpm	SHA-256: dbb524c6c0c5171ad20c25535e6a388bb91f61c5a77fb8d215abd6c5011fa76e
postfix-2.1.5-4.2.RHEL4.x86_64.rpm	SHA-256: dbb524c6c0c5171ad20c25535e6a388bb91f61c5a77fb8d215abd6c5011fa76e
postfix-pflogsumm-2.1.5-4.2.RHEL4.x86_64.rpm	SHA-256: c1f0f1ef99fa25c0d24aa42c2884fb7e5d789d5a5f39a1640d80c00fb750fd12
postfix-pflogsumm-2.1.5-4.2.RHEL4.x86_64.rpm	SHA-256: c1f0f1ef99fa25c0d24aa42c2884fb7e5d789d5a5f39a1640d80c00fb750fd12
ia64
postfix-2.1.5-4.2.RHEL4.ia64.rpm	SHA-256: 604fe1d804c1a1a6cea9c0b5b715eedcf3744ebdbf94b2c752a83f4e483b2b55
postfix-2.1.5-4.2.RHEL4.ia64.rpm	SHA-256: 604fe1d804c1a1a6cea9c0b5b715eedcf3744ebdbf94b2c752a83f4e483b2b55
postfix-pflogsumm-2.1.5-4.2.RHEL4.ia64.rpm	SHA-256: 2e3a4574faeab4bb2f2b2e8d29e4b2ac2611f849d23f8e64361e6bdffbae5541
postfix-pflogsumm-2.1.5-4.2.RHEL4.ia64.rpm	SHA-256: 2e3a4574faeab4bb2f2b2e8d29e4b2ac2611f849d23f8e64361e6bdffbae5541
i386
postfix-2.1.5-4.2.RHEL4.i386.rpm	SHA-256: dc8dc5a2766a1fa5ea26b5af2fd8d489813752818dee92a6fc5f2c03dafe620d
postfix-2.1.5-4.2.RHEL4.i386.rpm	SHA-256: dc8dc5a2766a1fa5ea26b5af2fd8d489813752818dee92a6fc5f2c03dafe620d
postfix-pflogsumm-2.1.5-4.2.RHEL4.i386.rpm	SHA-256: 592dca6f23931ca677ea18a762c2a23872bfe9f9a9eee25de4e4a04cf452b4da
postfix-pflogsumm-2.1.5-4.2.RHEL4.i386.rpm	SHA-256: 592dca6f23931ca677ea18a762c2a23872bfe9f9a9eee25de4e4a04cf452b4da

Red Hat Enterprise Linux Workstation 4

SRPM
postfix-2.1.5-4.2.RHEL4.src.rpm	SHA-256: 07d7e5f50a6195e5dbbc3e620aeb66ca5f0f45f27dd58db117881b9b18530f53
x86_64
postfix-2.1.5-4.2.RHEL4.x86_64.rpm	SHA-256: dbb524c6c0c5171ad20c25535e6a388bb91f61c5a77fb8d215abd6c5011fa76e
postfix-pflogsumm-2.1.5-4.2.RHEL4.x86_64.rpm	SHA-256: c1f0f1ef99fa25c0d24aa42c2884fb7e5d789d5a5f39a1640d80c00fb750fd12
ia64
postfix-2.1.5-4.2.RHEL4.ia64.rpm	SHA-256: 604fe1d804c1a1a6cea9c0b5b715eedcf3744ebdbf94b2c752a83f4e483b2b55
postfix-pflogsumm-2.1.5-4.2.RHEL4.ia64.rpm	SHA-256: 2e3a4574faeab4bb2f2b2e8d29e4b2ac2611f849d23f8e64361e6bdffbae5541
i386
postfix-2.1.5-4.2.RHEL4.i386.rpm	SHA-256: dc8dc5a2766a1fa5ea26b5af2fd8d489813752818dee92a6fc5f2c03dafe620d
postfix-pflogsumm-2.1.5-4.2.RHEL4.i386.rpm	SHA-256: 592dca6f23931ca677ea18a762c2a23872bfe9f9a9eee25de4e4a04cf452b4da

Red Hat Enterprise Linux Desktop 4

SRPM
postfix-2.1.5-4.2.RHEL4.src.rpm	SHA-256: 07d7e5f50a6195e5dbbc3e620aeb66ca5f0f45f27dd58db117881b9b18530f53
x86_64
postfix-2.1.5-4.2.RHEL4.x86_64.rpm	SHA-256: dbb524c6c0c5171ad20c25535e6a388bb91f61c5a77fb8d215abd6c5011fa76e
postfix-pflogsumm-2.1.5-4.2.RHEL4.x86_64.rpm	SHA-256: c1f0f1ef99fa25c0d24aa42c2884fb7e5d789d5a5f39a1640d80c00fb750fd12
i386
postfix-2.1.5-4.2.RHEL4.i386.rpm	SHA-256: dc8dc5a2766a1fa5ea26b5af2fd8d489813752818dee92a6fc5f2c03dafe620d
postfix-pflogsumm-2.1.5-4.2.RHEL4.i386.rpm	SHA-256: 592dca6f23931ca677ea18a762c2a23872bfe9f9a9eee25de4e4a04cf452b4da

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
postfix-2.1.5-4.2.RHEL4.src.rpm	SHA-256: 07d7e5f50a6195e5dbbc3e620aeb66ca5f0f45f27dd58db117881b9b18530f53
s390x
postfix-2.1.5-4.2.RHEL4.s390x.rpm	SHA-256: dcf40d65b597250a120c189a26f5be18f7557bf0989a4f265f2b47a6157643b4
postfix-pflogsumm-2.1.5-4.2.RHEL4.s390x.rpm	SHA-256: 185c13efdef27ebb42098b6e8507a9c586ad598b2bb1bd7b6666a2a479e3560b
s390
postfix-2.1.5-4.2.RHEL4.s390.rpm	SHA-256: 7be6244b83e8c8909bad9abbd28af1bc413cb8012b421ce8b0073bace0312af6
postfix-pflogsumm-2.1.5-4.2.RHEL4.s390.rpm	SHA-256: ce26217bba282989ad1a9714cc87618265a5c993403bcab4aa66b7f66416db3d

Red Hat Enterprise Linux for Power, big endian 4

SRPM
postfix-2.1.5-4.2.RHEL4.src.rpm	SHA-256: 07d7e5f50a6195e5dbbc3e620aeb66ca5f0f45f27dd58db117881b9b18530f53
ppc
postfix-2.1.5-4.2.RHEL4.ppc.rpm	SHA-256: 00aebf6abcb5b294fc3c564b7c868feac8c718e1d4c907ea3ab1c89f9f08fb13
postfix-pflogsumm-2.1.5-4.2.RHEL4.ppc.rpm	SHA-256: 71b89ae56cb294ce4ad83a5404d29fade872ef82e420572462ba99660fcb9d77