Re: CVE request: dovecot : "APPEND" Parameters Processing Denial of Service Vulnerability

[Timo Sirainen <tss () iki fi>]

On 22.5.2013, at 15.17, Jan Lieskovsky <jlieskov () redhat com> wrote:

> ----- Original Message -----
> > From: "Agostino Sarubbo" <ago () gentoo org>
> > To: oss-security () lists openwall com
> > Sent: Tuesday, May 21, 2013 8:58:04 PM
> > Subject: [oss-security] CVE request: dovecot : "APPEND" Parameters Processing Denial of Service Vulnerability
> >
> > From the secunia advisory SA53492[1] :
> >
> > Description
> > A vulnerability has been reported in Dovecot, which can be exploited by
> > malicious users to cause a DoS (Denial of Service).
> >
> > The vulnerability is caused due to an error within IMAP functionality when
> > processing the "APPEND" parameters and can be exploited to cause a hang.
>
> Timo, in relation with the previous (similar) one (thanks to Tomas Hoger for
> pointing out):
>  [1] http://thread.gmane.org/gmane.comp.security.oss.general/8916/focus=8934
>  [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15
>
> this time the CVE identifier should be allocated / issue is valid, right?
>
> While in the former [1], [2] case just the connection for the user issuing
> the command would crash, this time (assuming) either whole dovecot daemon
> might hang or even if the whole daemon wouldn't hang (and request is handled
> within a thread), that request would made the particular thread to consume
> excessive amount of CPU due to infinite loop, right?

A logged in user can cause his own IMAP connection process to eat 100% CPU, so it won't immediately hang other users. 
By default users can log in max. 10 times from the same IP, so attacker requires many IPs to cause a real DoS. And of 
course a valid user account, which means it will be immediately visible to admin who is causing the system to slow down.

> Timo, can you confirm / disprove a CVE identifier should be assigned to this?

I'm not against it, but I don't see this as that big of an issue, especially with v2.2 still not being widely used.

> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
> > The vulnerability is reported in version 2.2.
> >
> >
> > Solution
> > Update to version 2.2.2.
> >
> > Provided and/or discovered by
> > Reported by the vendor.
> >
> > Original Advisory
> > http://www.dovecot.org/list/dovecot-news/2013-May/000255.html
> >
> > Commit:
> > http://hg.dovecot.org/dovecot-2.2/rev/ea0390e1789f
> >
> > [1]: https://secunia.com/advisories/53492/
> >
> > --
> > Agostino Sarubbo
> > Gentoo Linux Developer