OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Postfix vulnerability'

From: Wietse Venema (wietseporcupine.org)
Date: Mon Feb 07 2005 - 07:34:25 CST


Victor Duchovni:
> On Mon, Feb 07, 2005 at 12:42:03AM -0500, Tom Diehl wrote:
>
> > On Mon, 7 Feb 2005, John Madden wrote:
> >
> > > > It would be nice if Linux distributors could indicate whether a
> > > > Postfix problem is part of the software base itself, or due to a
> > > > third-party add-on that they included with the base software.
> > >
> > > ...Sure would be nice if Linux vendors stopped wrecking a good thing by
> > > distributing non-standard components (attention: Redhat) with their
> >
> > Although I will admit that the first rpm yanked from my Red Hat systems
> > is the postfix rpm I am courious what you call "non-standard components"
> > wrt to Red Hat's postfix rpm.
> >
>
> The brain-damage inflicted on get_hostname() is a good start. The
> proposed bug fix (no checks for NULL results from gethostbyX()) is a
> mere band-aid. The entire idea of reverse-resolving the system hostname
> is very lame. Those who do not understand Postfix should not be allowed
> to change it. Those who don't have a good C programming skills, should
> not write code without adult supervision.

Calling gethostbyname() is a well-intended mistake to get the
fully qualified hostname, in the case that the kernel hostname
is just a short name.

However, gethostbyname() causes all kinds of grief when the name
isn't listed in /etc/hosts. The lookup will go to the DNS which
may not be available. As a result, system boots will hang and users
will experience poor performance.

        Wietse

        Wietse