PT-2005-1030 · Postgrey+1 · Postgrey+1

David Schweikert + 2 · Published 2005-04-16 · Updated 2017-07-11 · CVE-2005-1127

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Postgrey version 1.18 and earlier Net::Server versions 0.87 and earlier

Description The issue is related to a format string vulnerability in the log function of Net::Server, which is used in Postgrey. This vulnerability allows remote attackers to cause a denial of service (crash) by sending format string specifiers that are not properly handled before being sent to syslog. For example, this can be demonstrated using sender addresses to Postgrey. The vulnerability can be exploited remotely, potentially leading to a disruption in the availability of protected information.

Recommendations For Postgrey version 1.18 and earlier, update to a version later than 1.18 to resolve the issue. For Net::Server versions 0.87 and earlier, update to a version later than 0.87 to resolve the issue. As a temporary workaround, consider restricting access to the log function in Net::Server to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-02976

CVE-2005-1127

DSA-1121

DSA-1122

Affected Products

Net-Server

Postgrey

References · 23

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1127 · Security Note
• https://osv.dev/vulnerability/CVE-2005-1127 · Vendor Advisory
• http://debian.org/security/2006/dsa-1121 · Vendor Advisory
• http://secunia.com/advisories/14958 · Patch
• http://debian.org/security/2006/dsa-1122 · Vendor Advisory
• http://lists.ee.ethz.ch/postgrey/msg00647.html · Patch
• http://mandriva.com/security/advisories?name=MDKSA-2006:131 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200608-18.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-1127 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-1127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1127 · Security Note
• https://bdu.fstec.ru/vul/2015-02976 · Security Note
• http://lists.ee.ethz.ch/postgrey/msg00630.html · Note
• http://osvdb.org/15517 · Note
• http://secunia.com/advisories/21149 · Note