CVE-2011-1720

The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are…

published May 13, 2011

CVSS

—

EPSS

21%

Percentile

97.6

In the wild

Unconfirmed

What it is

The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.21481 · 97.6th percentile
Published: 2011-05-13T17:00Z

EPSS history

Timeline

13 MAY 17:00Z
The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are…
cvelistv5