oss-security - Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121204224821.GE2689@redhat.com>
Date: Tue, 4 Dec 2012 15:48:21 -0700
From: Vincent Danen <vdanen@...hat.com>
To: Moritz Muehlenhoff <jmm@...ian.org>
Cc: oss-security@...ts.openwall.com, Kurt Seifried <kseifried@...hat.com>
Subject: Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11)

* [2012-12-04 23:01:42 +0100] Moritz Muehlenhoff wrote:

>On Tue, Dec 04, 2012 at 06:12:29PM +0100, Matthias Weckbecker wrote:
>> Hi Kurt, Vincent, vendors, ...
>>
>> Quoting Kurt Seifried <kseifried@...hat.com>:
>> >-----BEGIN PGP SIGNED MESSAGE-----
>> >Hash: SHA1
>> >
>> >On 12/03/2012 10:33 AM, Vincent Danen wrote:
>> >>Could a CVE be assigned for the following please?
>> >>
>> >>Dovecot 2.1.11 was released and includes a fix for a crash
>> >>condition when the IMAP server was issued a SEARCH command with
>> >>multiple KEYWORD parameters.  An authenticated remote user could
>> >>use this flaw to crash Dovecot.
>> >>
>> [...]
>> >>
>> >>
>> >>Thanks.
>> >
>> >Please use CVE-2012-5620 for this issue.
>> >
>>
>> We were discussing this issue too at [1] and think that it does only
>> affect the current connection, no subsequent (i.e. new) connections
>> are affected.
>>
>> What's your opinion wrt this?
>>
>> [1] https://bugzilla.novell.com/show_bug.cgi?id=792642
>
>Upstream (Timo Sirainen) disputed the issue in the Debian BTS:
>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15

Ahhh... yes, Timo is correct.  If you're only DoS'ing your own
connection, I wouldn't consider this a flaw.

I (mistakenly) thought this took down the entire dovecot server.  My
apologies.

Can we have this CVE rejected or disputed?  As Timo says, it's a
pointless CVE.

Thanks, and sorry about that.

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.