Bug 48629 – Postfix allows to send mails even if no mailPrimaryAddress is specified in LDAP

Bug 48629 - Postfix allows to send mails even if no mailPrimaryAddress is specified in LDAP


Summary:	Postfix allows to send mails even if no mailPrimaryAddress is specified in LDAP

Status:	NEEDMOREINFO

Product:	UCS
Classification:	Unclassified
Component:	Mail
Version:	UCS 5.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Mail maintainers
QA Contact:	Mail maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2019-02-07 16:44 CET by Sönke Schwardt-Krummrich
Modified:	2021-05-03 21:58 CEST (History)
CC List:	3 users (show)

See Also:	40609
What kind of report is it?:	Bug Report
What type of bug is this?:	3: Simply Wrong: The implementation doesn't match the docu
Who will be affected by this bug?:	3: Will affect average number of installed domains
How will those affected feel about the bug?:	2: A Pain – users won’t like this once they notice it
User Pain:	0.103
Enterprise Customer affected?:
School Customer affected?:	Yes
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sönke Schwardt-Krummrich

2019-02-07 16:44:55 CET

Currently postfix allows a SMTP login via $UID even if no mailPrimaryAddress is specified for that user object in LDAP. Like any other UCS user with mailPrimaryAddress, the user is able to send mails with an arbitrary sender address.
The respective user account can only be identified via the mail.log file but not via mail headers.

Comment 1 Ingo Steuwer

2019-05-17 08:55:01 CEST

Would fixing Bug #40609 fix this, too?

Comment 2 Daniel Tröder

2019-05-17 11:17:56 CEST

(In reply to Ingo Steuwer from comment #1)
> Would fixing Bug #40609 fix this, too?
Not sure about the current implementation, but it could be used to to prevent this scenario.