Postfix bounces arbitrary content

["Vincent Danen" <vdanen () redhat com>]

I noticed this bug in the Debian BTS and didn't see it mentioned anywhere:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741888

I'm going to copy-n-paste a bit of the bug below for context:

"""
An unmodified Postfix install can be made to bounce arbitrary
content from an arbitrary internal address to an arbitrary external
address, by an external sender who has no affiliation with the
organization that's running Postfix.

The possibilities for offensive use of this exploit are interesting.
Suppose I want to prevent alice () a com from receiving an important
message that I think bob () b com may be about to send to her.  I can
take 5,000 randomly selected articles from my local news spool, and
cause b.com to bounce all of them from bob () b com to postmaster () a com.
This will likely cause a.com to block incoming mail from bob () b com,
or from all of b.com... thus blocking Bob's message to Alice.
"""

The reporter also references an almost-10-year-old email message to the postfix-user mailing list (to which there were 
no replies):

http://article.gmane.org/gmane.mail.postfix.user/96511

I don't believe this was reported to upstream at all, but I can't be 100% sure of that.

I'm not so much looking for a CVE assignment (unless one is warranted) as much as some determination as to whether or 
not this is a flaw because the way I see it, it's no different the spoofing the origin of an email (someone else's 
email address) to cause bounces to go to that address and with the same end result (from what it sounds to me).  It's 
quite possible that I'm missing something, but given there was no response to a similar message from 10 years ago, I'm 
not sure if it got missed or no one cares (or think it security-relevant or otherwise exciting).

Anyways, I see this bug in the Debian BTS and I see no response from Debian maintainers or any indication it was 
reported upstream, so I was curious what others might think or if I'm missing something (because I don't see anything 
too terribly exciting here).

Thanks.

-- 
Vincent Danen / Red Hat Security Response Team

Attachment: signature.asc
Description: OpenPGP digital signature