oss-security - CVE request: Denial of Service attacks against Dovecot v1.1+

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140509131133.GA17772@kludge.henri.nerv.fi>
Date: Fri, 9 May 2014 16:11:33 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Subject: CVE request: Denial of Service attacks against Dovecot v1.1+

Hello,

Can I get CVE identifier for DoS attacks against Dovecot v1.1+, thank you.

http://permalink.gmane.org/gmane.mail.imap.dovecot/77499

"""
There's an upper limit to how many IMAP/POP3 connections can exist that haven't logged in (and separate
limits for post-login). Normally when this limit is reached, the oldest connection gets disconnected.
There is of course some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections, but because
the oldest connection always gets destroyed this requires quite a lot of activity from the attacker.

This "destroy oldest connection" however hasn't been working in v1.1+ releases for connections that have
started SSL/TLS handshake, but haven't finished it. So an attacker could just do a bunch of TCP
connections to port 993 and leave them hanging around and Dovecot would pretty quickly reach the upper
limit without being able to disconnect any of the oldest connections.

Here are patches to fix this:

http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3
http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339
http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc
http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b
http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c

The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For older releases you need to
patch it yourself.

For people who are using dovecot-ee releases the fix is also in v2.2.12.12 and v2.1.7.7 releases.
"""

---
Henri Salo

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.