[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <31370FCF-2829-4A55-82C1-7531C4761C6A@iki.fi>
Date: Wed, 14 Aug 2013 18:40:38 +0300
From: Timo Sirainen <tss@....fi>
To: Raphael Geissert <geissert@...ian.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: Possible CVE request: dovecot crash when disconnecting during pop3 LIST
On 14.8.2013, at 18.30, Raphael Geissert <geissert@...ian.org> wrote:
> Dovecot's 2.2.5 release notes mention a fix for a client-triggered
> assert when disconnecting during a pop3 LIST[1]. Without more details,
> I can't tell if a CVE id should be assigned. Timo, could you please
> shed some more light, or provide a pointer to more details?
It doesn't deserve a CVE, there have been a lot of similar bugs in Dovecot and I don't think any of them have gotten a CVE. All post-login crashes affect only the one IMAP/POP3 connection that caused the crash itself, nobody else. (Unless Dovecot was configured in a non-recommended way to handle multiple clients per process, but just about nobody does that since it has other problems as well.) In this specific bug the POP3 client had already disconnected so the user isn't really DoSing himself either. So the only problem it caused was that Dovecot logged an assert error and maybe wrote a core dump.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
