Description
Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate with the target on the associated port.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postfix | 1.1.12 | — |
| Debian 13 | postfix | 1.1.12 | — |
| Debian 12 | postfix | 1.1.12 | — |
| Debian 3.0 | postfix | 1.1.11-0.woody3 | DSA-363 |
Advisories 1
- DSA-363 postfix - denial of service, bounce-scanning Debian Security (DSA / DLA) · Mar 9, 2026
References
- CLA-2003:717 vendor-advisory
- 8333 vdb-entry
- MDKSA-2003:081 vendor-advisory
- RHSA-2003:251 vendor-advisory
- DSA-363 vendor-advisory
- 20030804 Postfix 1.1.12 remote DoS / Postfix 1.1.11 bounce scanning mailing-list
- SuSE-SA:2003:033 vendor-advisory
- 9433 third-party-advisory
- oval:org.mitre.oval:def:522 vdb-entry signature