Script `smtp-vuln-cve2011-1720`

Script types: portrule
Categories: intrusive, vuln
Download: https://svn.nmap.org/nmap/scripts/smtp-vuln-cve2011-1720.nse

Script Summary

Checks for a memory corruption in the Postfix SMTP server when it uses Cyrus SASL library authentication mechanisms (CVE-2011-1720). This vulnerability can allow denial of service and possibly remote code execution.

Reference:

http://www.postfix.org/CVE-2011-1720.html

Script Arguments

smtp.domain: See the documentation for the smtp library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.
vulns.short, vulns.showall: See the documentation for the vulns library.

Example Usage

nmap --script=smtp-vuln-cve2011-1720 --script-args='smtp.domain=<domain>' -pT:25,465,587 <host>

Script Output

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-vuln-cve2011-1720:
|   VULNERABLE:
|   Postfix SMTP server Cyrus SASL Memory Corruption
|     State: VULNERABLE
|     IDs:  CVE:CVE-2011-1720  BID:47778
|     Description:
|       The Postfix SMTP server is vulnerable to a memory corruption vulnerability
|       when the Cyrus SASL library is used with authentication mechanisms other
|       than PLAIN and LOGIN.
|     Disclosure date: 2011-05-08
|     Check results:
|       AUTH tests: CRAM-MD5 NTLM
|     Extra information:
|       Available AUTH MECHANISMS:  CRAM-MD5 DIGEST-MD5 NTLM PLAIN LOGIN
|     References:
|       http://www.postfix.org/CVE-2011-1720.html
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1720
|_      https://www.securityfocus.com/bid/47778

Requires

Author:

Djalal Harouni