« Volver al listado

CVE-2003-0540

Estado: ModificadaMedia (5)—

The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the ".!" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a ".!" string, which causes an instance of the SMTP listener to lock up.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Conectiva — LinuxWietse Venema — Postfix

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2003-0540",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2003-08-27T04:00:00.000",
  "references": [
    {
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-August/007693.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=106001525130257&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=106029188614704&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/9433",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2003/dsa-363",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/895508",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.linuxsecurity.com/advisories/engarde_advisory-3517.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:081",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.novell.com/linux/security/advisories/2003_033_postfix.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2003-251.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/8333",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A544",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-August/007693.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=106001525130257&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=106029188614704&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/9433",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2003/dsa-363",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/895508",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.linuxsecurity.com/advisories/engarde_advisory-3517.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:081",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.novell.com/linux/security/advisories/2003_033_postfix.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2003-251.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/8333",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A544",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the \".!\" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a \".!\" string, which causes an instance of the SMTP listener to lock up."
    },
    {
      "lang": "es",
      "value": "El código de procesamiento de direcciones en Postfix 1.1.12 y anteriores permite a atacantes remotos causar una denegación de servicio (bloqueo) mediante (1) una dirección envoltorio malformada a una máquina local que generaría un rebote y que contenga la cadena \".!\" en las cabeceras MAIL FROM Y Errors-To, lo que hace que nqmgrse cuelge, o (2) mediante un MAIL FROM con un RCPT TO conteniendo una cadena \".!\", lo que hace que una instancia del oyente SMTP se cuelgue."
    }
  ],
  "lastModified": "2026-06-16T22:02:23.597",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wietse_venema:postfix:1.0.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8C70650-45F8-42F1-863E-C14CFD27986D"
            },
            {
              "criteria": "cpe:2.3:a:wietse_venema:postfix:1.1.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6886742C-C8CF-4DE8-812C-30CB19984329"
            },
            {
              "criteria": "cpe:2.3:a:wietse_venema:postfix:1.1.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "560E65A3-1583-45D5-AAB4-352E09B74C21"
            },
            {
              "criteria": "cpe:2.3:a:wietse_venema:postfix:1999-09-06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8F498EC-BAB8-44E9-A1E9-F5FE59D969E7"
            },
            {
              "criteria": "cpe:2.3:a:wietse_venema:postfix:1999-12-31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AC09670-77D3-40B7-BD0A-2F447FAB272E"
            },
            {
              "criteria": "cpe:2.3:a:wietse_venema:postfix:2000-02-28:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "711ECD8D-66D7-414E-B509-9F10A93FCED8"
            },
            {
              "criteria": "cpe:2.3:a:wietse_venema:postfix:2001-11-15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C6E6C91-AE96-481F-92F5-C56F45ABE8E3"
            },
            {
              "criteria": "cpe:2.3:o:conectiva:linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97177EF7-8FC4-4D4D-A8D9-3628AA0035FB"
            },
            {
              "criteria": "cpe:2.3:o:conectiva:linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD14661C-E3BE-44DF-BC8D-294322BF23EA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}