[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <B9688A2D-7F5D-4E9E-BA74-A41B35B7DD73@iki.fi>
Date: Wed, 22 May 2013 15:24:59 +0300
From: Timo Sirainen <tss@....fi>
To: Jan Lieskovsky <jlieskov@...hat.com>
Cc: Agostino Sarubbo <ago@...too.org>,
oss-security@...ts.openwall.com
Subject: Re: CVE request: dovecot : "APPEND" Parameters Processing Denial of Service Vulnerability
On 22.5.2013, at 15.17, Jan Lieskovsky <jlieskov@...hat.com> wrote:
> ----- Original Message -----
>> From: "Agostino Sarubbo" <ago@...too.org>
>> To: oss-security@...ts.openwall.com
>> Sent: Tuesday, May 21, 2013 8:58:04 PM
>> Subject: [oss-security] CVE request: dovecot : "APPEND" Parameters Processing Denial of Service Vulnerability
>>
>> From the secunia advisory SA53492[1] :
>>
>> Description
>> A vulnerability has been reported in Dovecot, which can be exploited by
>> malicious users to cause a DoS (Denial of Service).
>>
>> The vulnerability is caused due to an error within IMAP functionality when
>> processing the "APPEND" parameters and can be exploited to cause a hang.
>
> Timo, in relation with the previous (similar) one (thanks to Tomas Hoger for
> pointing out):
> [1] http://thread.gmane.org/gmane.comp.security.oss.general/8916/focus=8934
> [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15
>
> this time the CVE identifier should be allocated / issue is valid, right?
>
> While in the former [1], [2] case just the connection for the user issuing
> the command would crash, this time (assuming) either whole dovecot daemon
> might hang or even if the whole daemon wouldn't hang (and request is handled
> within a thread), that request would made the particular thread to consume
> excessive amount of CPU due to infinite loop, right?
A logged in user can cause his own IMAP connection process to eat 100% CPU, so it won't immediately hang other users. By default users can log in max. 10 times from the same IP, so attacker requires many IPs to cause a real DoS. And of course a valid user account, which means it will be immediately visible to admin who is causing the system to slow down.
> Timo, can you confirm / disprove a CVE identifier should be assigned to this?
I'm not against it, but I don't see this as that big of an issue, especially with v2.2 still not being widely used.
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
>>
>> The vulnerability is reported in version 2.2.
>>
>>
>> Solution
>> Update to version 2.2.2.
>>
>> Provided and/or discovered by
>> Reported by the vendor.
>>
>> Original Advisory
>> http://www.dovecot.org/list/dovecot-news/2013-May/000255.html
>>
>> Commit:
>> http://hg.dovecot.org/dovecot-2.2/rev/ea0390e1789f
>>
>> [1]: https://secunia.com/advisories/53492/
>>
>> --
>> Agostino Sarubbo
>> Gentoo Linux Developer
>>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
