Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 24 May 2013 01:17:40 -0600
From: Kurt Seifried <>
CC: Timo Sirainen <>, Jan Lieskovsky <>,
        Agostino Sarubbo <>
Subject: Re: CVE request: dovecot : "APPEND" Parameters Processing
 Denial of Service Vulnerability

Hash: SHA1

On 05/22/2013 06:24 AM, Timo Sirainen wrote:
> On 22.5.2013, at 15.17, Jan Lieskovsky <>
> wrote:
>> ----- Original Message -----
>>> From: "Agostino Sarubbo" <> To:
>>> Sent: Tuesday, May 21, 2013
>>> 8:58:04 PM Subject: [oss-security] CVE request: dovecot :
>>> "APPEND" Parameters Processing Denial of Service Vulnerability
>>> From the secunia advisory SA53492[1] :
>>> Description A vulnerability has been reported in Dovecot, which
>>> can be exploited by malicious users to cause a DoS (Denial of
>>> Service).
>>> The vulnerability is caused due to an error within IMAP
>>> functionality when processing the "APPEND" parameters and can
>>> be exploited to cause a hang.
>> Timo, in relation with the previous (similar) one (thanks to
>> Tomas Hoger for pointing out): [1]
>> this time the CVE identifier should be allocated / issue is
>> valid, right?
>> While in the former [1], [2] case just the connection for the
>> user issuing the command would crash, this time (assuming) either
>> whole dovecot daemon might hang or even if the whole daemon
>> wouldn't hang (and request is handled within a thread), that
>> request would made the particular thread to consume excessive
>> amount of CPU due to infinite loop, right?
> A logged in user can cause his own IMAP connection process to eat
> 100% CPU, so it won't immediately hang other users. By default
> users can log in max. 10 times from the same IP, so attacker
> requires many IPs to cause a real DoS. And of course a valid user
> account, which means it will be immediately visible to admin who is
> causing the system to slow down.
>> Timo, can you confirm / disprove a CVE identifier should be
>> assigned to this?
> I'm not against it, but I don't see this as that big of an issue,
> especially with v2.2 still not being widely used.

Yeah, we can't guarantee that can we. For all we know someone used it
in a major deployment/system image/who knows.

Please use CVE-2013-2111 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Version: GnuPG v1.4.13 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.