Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 31 Jan 2014 12:08:01 +0100
From: Michael Kromer <>
Cc: Robert Scheck <>, 
 Robert Scheck <>, <>
Subject: Security Flaw CVE-2014-0037


Affected product: Zarafa Collaboration Platform <= 7.1.7

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Complete

A flaw in Zarafa has been discovered that allows a remote unauthenticated attacker to crash the zarafa-server daemon with a segmentation fault, preventing access to any other legitimate Zarafa users. This flaw has been fixed beginning with the release of Zarafa 7.1.8 beta2 ( ). We encourage any users of Zarafa to update to this new version or apply the patch supplied below.

Zarafa would like to thank Robert Scheck from ETES ( for discovering and reporting this issue.

Index: provider/libserver/ECSession.cpp
diff -u -N -r41872 -r42919
--- provider/libserver/ECSession.cpp	(.../ECSession.cpp)	(revision 41872)
+++ provider/libserver/ECSession.cpp	(.../ECSession.cpp)	(revision 42919)
@@ -846,6 +846,13 @@
 	ECRESULT er = erSuccess;
+	if (!lpszName)
+	{
+		// Commandment 2: Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end.
+		m_lpSessionManager->GetLogger()->Log(EC_LOGLEVEL_FATAL, "Invalid argument lpszName in call to ECAuthSession::ValidateUserLogon()");
+		goto exit;
+	}
 	// SYSTEM can't login with user/pass
 	if(stricmp(lpszName, ZARAFA_ACCOUNT_SYSTEM) == 0) {
@@ -888,6 +895,12 @@
 	char			*localAdminUsers = NULL;
+	if (!lpszName)
+	{
+		m_lpSessionManager->GetLogger()->Log(EC_LOGLEVEL_FATAL, "Invalid argument lpszName in call to ECAuthSession::ValidateUserSocket()");
+		goto exit;
+	}
 	p = m_lpSessionManager->GetConfig()->GetSetting("allow_local_users");
 	if (p && !stricmp(p, "yes")) {
 		allowLocalUsers = true;

Mit freundlichen Grüßen,
Best regards,
Met vriendelijke groet,
Cordiali saluti,

Michael Kromer
VP Products & Architecture

[T] +49 179 9300840
Zarafa: Open - Compatible - Enterprise

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.