oss-security - Re: CVE request: dovecot : "APPEND" Parameters Processing Denial of Service Vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1534621804.5617953.1369225060745.JavaMail.root@redhat.com>
Date: Wed, 22 May 2013 08:17:40 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Timo Sirainen <tss@....fi>
Cc: Agostino Sarubbo <ago@...too.org>, oss-security@...ts.openwall.com
Subject: Re: CVE request: dovecot : "APPEND" Parameters
 Processing Denial of Service Vulnerability

Thank you for the report, Agostino.

Cc-ing Timo to clarify on the point below yet.

----- Original Message -----
> From: "Agostino Sarubbo" <ago@...too.org>
> To: oss-security@...ts.openwall.com
> Sent: Tuesday, May 21, 2013 8:58:04 PM
> Subject: [oss-security] CVE request: dovecot : "APPEND" Parameters Processing Denial of Service Vulnerability
> 
> From the secunia advisory SA53492[1] :
> 
> Description
> A vulnerability has been reported in Dovecot, which can be exploited by
> malicious users to cause a DoS (Denial of Service).
> 
> The vulnerability is caused due to an error within IMAP functionality when
> processing the "APPEND" parameters and can be exploited to cause a hang.

Timo, in relation with the previous (similar) one (thanks to Tomas Hoger for
pointing out):
  [1] http://thread.gmane.org/gmane.comp.security.oss.general/8916/focus=8934
  [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15

this time the CVE identifier should be allocated / issue is valid, right?

While in the former [1], [2] case just the connection for the user issuing
the command would crash, this time (assuming) either whole dovecot daemon
might hang or even if the whole daemon wouldn't hang (and request is handled
within a thread), that request would made the particular thread to consume
excessive amount of CPU due to infinite loop, right?

Timo, can you confirm / disprove a CVE identifier should be assigned to this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> 
> The vulnerability is reported in version 2.2.
> 
> 
> Solution
> Update to version 2.2.2.
> 
> Provided and/or discovered by
> Reported by the vendor.
> 
> Original Advisory
> http://www.dovecot.org/list/dovecot-news/2013-May/000255.html
> 
> Commit:
> http://hg.dovecot.org/dovecot-2.2/rev/ea0390e1789f
> 
> [1]: https://secunia.com/advisories/53492/
> 
> --
> Agostino Sarubbo
> Gentoo Linux Developer
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.