Re: Possible CVE request: dovecot crash when disconnecting during pop3 LIST

[Timo Sirainen <tss () iki fi>]

On 14.8.2013, at 18.30, Raphael Geissert <geissert () debian org> wrote:

> Dovecot's 2.2.5 release notes mention a fix for a client-triggered
> assert when disconnecting during a pop3 LIST[1]. Without more details,
> I can't tell if a CVE id should be assigned. Timo, could you please
> shed some more light, or provide a pointer to more details?


It doesn't deserve a CVE, there have been a lot of similar bugs in Dovecot and I don't think any of them have gotten a 
CVE. All post-login crashes affect only the one IMAP/POP3 connection that caused the crash itself, nobody else. (Unless 
Dovecot was configured in a non-recommended way to handle multiple clients per process, but just about nobody does that 
since it has other problems as well.) In this specific bug the POP3 client had already disconnected so the user isn't 
really DoSing himself either. So the only problem it caused was that Dovecot logged an assert error and maybe wrote a 
core dump.