Re: CVE request: dovecot : "APPEND" Parameters Processing Denial of Service Vulnerability

[Jan Lieskovsky <jlieskov () redhat com>]

Thank you for the report, Agostino.

Cc-ing Timo to clarify on the point below yet.

----- Original Message -----
> From: "Agostino Sarubbo" <ago () gentoo org>
> To: oss-security () lists openwall com
> Sent: Tuesday, May 21, 2013 8:58:04 PM
> Subject: [oss-security] CVE request: dovecot : "APPEND" Parameters Processing Denial of Service Vulnerability
>
> From the secunia advisory SA53492[1] :
>
> Description
> A vulnerability has been reported in Dovecot, which can be exploited by
> malicious users to cause a DoS (Denial of Service).
>
> The vulnerability is caused due to an error within IMAP functionality when
> processing the "APPEND" parameters and can be exploited to cause a hang.

Timo, in relation with the previous (similar) one (thanks to Tomas Hoger for
pointing out):
  [1] http://thread.gmane.org/gmane.comp.security.oss.general/8916/focus=8934
  [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15

this time the CVE identifier should be allocated / issue is valid, right?

While in the former [1], [2] case just the connection for the user issuing
the command would crash, this time (assuming) either whole dovecot daemon
might hang or even if the whole daemon wouldn't hang (and request is handled
within a thread), that request would made the particular thread to consume
excessive amount of CPU due to infinite loop, right?

Timo, can you confirm / disprove a CVE identifier should be assigned to this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> The vulnerability is reported in version 2.2.
>
>
> Solution
> Update to version 2.2.2.
>
> Provided and/or discovered by
> Reported by the vendor.
>
> Original Advisory
> http://www.dovecot.org/list/dovecot-news/2013-May/000255.html
>
> Commit:
> http://hg.dovecot.org/dovecot-2.2/rev/ea0390e1789f
>
> [1]: https://secunia.com/advisories/53492/
>
> --
> Agostino Sarubbo
> Gentoo Linux Developer