PT-2020-13021 · Postfix · Postfix

D7X + 1 · Published 2020-04-24 · Updated 2024-08-04 · CVE-2020-12063

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Postfix version 2.10.1-7

Description The issue allows an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of xcexbf to the 'o' character. This is potentially relevant when the /etc/postfix/sender login feature is used, because a spoofed outbound message that uses a configured sender address is blocked with a "Sender address rejected: not logged in" error message, but a spoofed outbound message that uses a homoglyph of a configured sender address is not blocked.

Recommendations For Postfix version 2.10.1-7, consider disabling the /etc/postfix/sender login feature until a patch is available to prevent exploitation of the homoglyph attack. Restrict access to the sender login feature to minimize the risk of spoofed outbound messages. Avoid using homoglyph characters in sender addresses to prevent potential spoofing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-12063

Affected Products

Postfix

References · 6

• 🔥 https://openwall.com/lists/oss-security/2020/04/23/12 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12063 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12063 · Vendor Advisory
• https://t.me/cvenotify/88967 · Telegram Post
• https://t.me/cvenotify/3177 · Telegram Post
• https://openwall.com/lists/oss-security/2020/04/23/3 · Note