Open-Xchange Dovecot 2.3.10 Null Pointer Dereference / Denial Of Service Vulnerabilities

------------------ Open-Xchange Security Advisory 2020-05-18 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3784 Vulnerability type: NULL pointer dereference CWE-476 Vulnerable version: 2.3.0 - 2.3.10 Vulnerable component: submission, lmtp Report confidence: Confirmed Solution...

PT-2020-12449 · Dovecot +7 · Dovecot +7

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.10.1 Description: A crafted SMTP/LMTP message can trigger an unauthenticated use-after-free bug in submission-login, submission, or lmtp, leading to a crash under circumstances involving many newlines after a...

PT-2020-12448 · Dovecot +6 · Dovecot +6

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.10.1 Description: The issue arises from sending malformed parameters to a NOOP command, which causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp. This can be triggered without...

PT-2020-12455 · Dovecot +7 · Dovecot +7

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.10.1 Description: The issue allows remote unauthenticated attackers to crash the lmtp or submission process by sending mail with an empty localpart. Recommendations: For versions prior to 2.3.10.1, update to...

Amazon Linux AMI : dovecot (ALAS-2020-1363)

The version of dovecot installed on the remote host is prior to 2.2.36-6.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1363 advisory. In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker...

Medium: dovecot

Issue Overview: In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components. CVE-2019-7524 It was discovered that...

Open-Xchange: Pre-auth Denial-of-Service in Dovecot RPA implementation

Hi, Dovecot security team. I am Orange from DEVCORE security team. We just did a little security audit on the authentication mechanism of Dovecot, and found a buffer over-read in RPA implementation. In the mech-rpa.c, the function rpareadbuffer doesn't check that the length could be zero, and pas...

Open-Xchange: Pre-auth buffer over-read in Dovecot NTLM implementation

Hi, Dovecot security team. I am Orange from DEVCORE security team. We just did a little security audit on the authentication mechanism of Dovecot, and found a buffer over-read in NTLM implementation. The structure of NTLM field is defined in ntlm-types.h c struct ntlmsspbuffer uint16t length; /...

Open-Xchange: reading the stack data of the imap process

in dovecot / core in the imap-client-hibernate.c file in the imaphibernatehandshake function, lines 31..39 contain vulnerable code: cpp else if ret = readfd, buf, sizeofbuf-1 0 && bufret-1 == '\n' bufret-1 = '\0'; if versionstringverifybuf, "imap-hibernate", 1 return 0; ierror"%s sent invalid...

mail/dovecot -- multiple vulnerabilities

Aki Tuomi reports: Parsing mails with a large number of MIME parts could have resulted in excessive CPU usage or a crash due to running out of stack memory.. Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash...

Scientific Linux Security Update : dovecot on SL7.x x86_64 (20200407)

dovecot: Improper certificate validation dovecot: Buffer overflow in indexer-worker process results in privilege escalation C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135805; scriptversion"1.3";...

Denial Of Service (DoS)

dovecot is vulnerable to denial of service. A denial of service flaw was found in the way Dovecot handled NULL characters in certain header names. A mail message with specially-crafted headers could cause the Dovecot child process handling the target user's connection to crash, blocking them from...

Denial Of Service (DoS)

dovecot is vulnerable to denial of service. A flaw was found in the way Dovecot handled SIGCHLD signals. If a large amount of IMAP or POP3 session disconnects caused the Dovecot master process to receive these signals rapidly, it could cause the master process to crash...

Access Control Bypass

dovecot is vulnerable to access control bypass. A flaw was found in the way Dovecot processed multiple Access Control Lists ACL defined for a mailbox. In some cases, Dovecot could fail to apply the more specific ACL entry, possibly resulting in more access being granted to the user than intended...

Information Disclosure

dovecot is vulnerable to information disclosure. A password disclosure flaw was found with Dovecot's configuration file. If a system had the "sslkeypassword" option defined, any local user could view the SSL key password...

Access Control Bypass

dovecot is vulnerable to access control bypass. A flaw was found in Dovecot's ACL plug-in. The ACL plug-in treated negative access rights as positive rights, which could allow an attacker to bypass intended access restrictions...

Privilege Escalation

dovecot is vulnerable to privilege escalation. A flaw was discovered in the way Dovecot handled the "mailextragroups" option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server...

Directory Traversal

dovecot is vulnerable to directory traversal. A directory traversal flaw was discovered in Dovecot's zlib plug-in. An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process...

Privilege Escalation

dovecot is vulnerable to privilege escalation. A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the "COPY" and "APPEND" commands to set additional message flags...

Authentication Bypass

dovecot is vulnerable to authentication bypass. A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password...