CVE-2003-0468
Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes…
Does this matter?
Lower severity and a low EPSS score (2.38%). Track it; it rarely justifies an emergency change on its own.
Description
Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate with the target on the associated port.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 2.38% probability · 83th percentile
- CISA KEV
- Not listed
- Affected
- wietse venema/postfix · conectiva/linux
- Source
- cve@mitre.org
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717
- http://marc.info/?l=bugtraq&m=106001525130257&w=2
- http://secunia.com/advisories/9433
- http://www.debian.org/security/2003/dsa-363Patch, Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2003:081
- http://www.novell.com/linux/security/advisories/2003_033_postfix.html
- http://www.redhat.com/support/errata/RHSA-2003-251.html
- http://www.securityfocus.com/bid/8333
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A522
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717
- http://marc.info/?l=bugtraq&m=106001525130257&w=2
- http://secunia.com/advisories/9433
- http://www.debian.org/security/2003/dsa-363Patch, Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2003:081
- http://www.novell.com/linux/security/advisories/2003_033_postfix.html
- http://www.redhat.com/support/errata/RHSA-2003-251.html
- http://www.securityfocus.com/bid/8333
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A522
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.