what you don't know can hurt you

Open-Xchange Dovecot 2.3.10 Null Pointer Dereference / Denial Of Service

Open-Xchange Dovecot 2.3.10 Null Pointer Dereference / Denial Of Service
Posted May 19, 2020
Authored by Philippe Antoine

Open-Xchange Dovecot versions 2.3.0 through 2.3.10 suffer from null pointer dereference and denial of service vulnerabilities.

tags | exploit, denial of service, vulnerability
advisories | CVE-2020-10957, CVE-2020-10958, CVE-2020-10967
SHA-256 | 3aa6155c0580d269fb7fdbdd9648de20d10f066c289ea5f31c5a7bb2f6be630b

Open-Xchange Dovecot 2.3.10 Null Pointer Dereference / Denial Of Service

Change Mirror Download
------------------

Open-Xchange Security Advisory 2020-05-18

Product: Dovecot
Vendor: OX Software GmbH

Internal reference: DOV-3784
Vulnerability type: NULL pointer dereference (CWE-476)
Vulnerable version: 2.3.0 - 2.3.10
Vulnerable component: submission, lmtp
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.3.10.1
Researcher credits: Philippe Antoine (Catena Cyber)
Vendor notification: 2020-03-24
Solution date: 2020-04-02
Public disclosure: 2020-05-18
CVE reference: CVE-2020-10957
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Vulnerability Details:
Sending malformed NOOP command causes crash in submission, submission-login or
lmtp service.

Risk:
Remote attacker can keep submission-login service down, causing denial of
service attack. For lmtp the risk is neglible, as lmtp is usually behind a
trusted MTA.

Steps to reproduce:
Send ``NOOP EE"FY`` to submission port, or similarly malformed command.

Solution:
Upgrade to fixed version.

------------------

Open-Xchange Security Advisory 2020-05-18

Product: Dovecot IMAP server
Vendor: OX Software GmbH

Internal reference: DOV-3875
Vulnerability type: Improper handling of input data (CWE-20)
Vulnerable version: 2.3.0 - 2.3.10
Vulnerable component: submission, lmtp
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.3.10.1
Researcher credits: Philippe Antoine (Catena Cyber)
Vendor notification: 2020-03-23
Solution date: 2020-04-02
Public disclosure: 2020-05-18
CVE reference: CVE-2020-10958
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Vulnerability Details:

Sending command followed by sufficient number of newlines triggers a
use-after-free bug that might crash submission-login, submission or
lmtp service.

Risk:

Remote attacker can keep submission-login service down, causing denial
of service attack. For lmtp the risk is neglible, as lmtp is usually
behind a trusted MTA.

Steps to reproduce:

This can be currently reproduced with ASAN or Valgrind. Reliable way to
crash has not yet been discovered.

Solution:

Upgrade to fixed version.

------------------

Open-Xchange Security Advisory 2020-05-18

Product: Dovecot
Vendor: OX Software GmbH

Internal reference: DOV-1745
Vulnerability type: Improper input validation (CWE-20)
Vulnerable version: 2.3.0 - 2.3.10
Vulnerable component: submission, lmtp
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.3.10.1
Researcher credits: mailbox.org
Vendor notification: 2020-03-20
Solution date: 2020-04-02
Public disclosure: 2020-05-18
CVE reference: CVE-2020-10967
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Vulnerability Details:
Sending mail with empty quoted localpart causes submission or lmtp component
to crash.

Risk:
Malicious actor can cause denial of service to mail delivery by repeatedly
sending mails with bad sender or recipient address.

Steps to reproduce:
Send mail with envelope sender or recipient as ``<""@example.org>``.

Workaround:
For submission there is no workaround, but triggering the bug requires valid
credentials.
For lmtp, one can implement sufficient filtering on MTA level to prevent mails
with such addresses from ending up in LMTP delivery.

Solution:
Upgrade to fixed version.

------------------
Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    19 Files
  • 25
    May 25th
    5 Files
  • 26
    May 26th
    12 Files
  • 27
    May 27th
    12 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close