Bug#741888: postfix: vulnerability, remotely exploitable, spews DSNs

2019-02-21 Thread Scott Kitterman
On Thursday, February 21, 2019 05:35:26 PM Robert Munyer wrote: > Control: found -1 3.1.9-0+deb9u2 > > Scott Kitterman wrote: > > I agree this is a problem. A design change like this should not be > > implemented at the distro level, so it's not a patch I would consider > > for Debian. It

Bug#741888: postfix: vulnerability, remotely exploitable, spews DSNs

2019-02-21 Thread Robert Munyer
Control: found -1 3.1.9-0+deb9u2 Scott Kitterman wrote: > I agree this is a problem. A design change like this should not be > implemented at the distro level, so it's not a patch I would consider > for Debian. It should be discussed with the upstream developers. Does upstream have a BTS? I

Bug#741888: postfix: vulnerability, remotely exploitable, spews DSNs

2014-03-16 Thread Robert Munyer
Package: postfix Version: 2.9.6-2 Severity: important Tags: patch security An unmodified Postfix install can be made to bounce arbitrary content from an arbitrary internal address to an arbitrary external address, by an external sender who has no affiliation with the organization that's running

Bug#741888: postfix: vulnerability, remotely exploitable, spews DSNs

2014-03-16 Thread Robert Munyer
diff -ur old/postfix-2.9.6/src/global/post_mail.c new/postfix-2.9.6/src/global/post_mail.c --- old/postfix-2.9.6/src/global/post_mail.c 2007-02-12 15:34:48.0 -0500 +++ new/postfix-2.9.6/src/global/post_mail.c 2014-03-08 07:31:00.0 -0500 @@ -165,6 +165,10 @@ #include post_mail.h