Bug 1096402 (CVE-2014-3430)

Summary:	CVE-2014-3430 dovecot: denial of service through maxxing out SSL connections
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fweimer, janfrode, jkurik, jrusnack, mhlavink, orion, psklenar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dovecot 2.2.13	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-25 17:43:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1096408, 1108001, 1108002, 1108003, 1108004, 1700473
Bug Blocks:	1096403

Description Vincent Danen 2014-05-09 20:49:35 UTC

As reported on oss-sec [1]:

There's an upper limit to how many IMAP/POP3 connections can exist that haven't logged in (and separate
limits for post-login). Normally when this limit is reached, the oldest connection gets disconnected.
There is of course some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections, but because
the oldest connection always gets destroyed this requires quite a lot of activity from the attacker.

This "destroy oldest connection" however hasn't been working in v1.1+ releases for connections that have
started SSL/TLS handshake, but haven't finished it. So an attacker could just do a bunch of TCP
connections to port 993 and leave them hanging around and Dovecot would pretty quickly reach the upper
limit without being able to disconnect any of the oldest connections.

Here are patches to fix this:

http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3
http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339
http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc
http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b
http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c

The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For older releases you need to
patch it yourself.

For people who are using dovecot-ee releases the fix is also in v2.2.12.12 and v2.1.7.7 releases.


[1] http://seclists.org/oss-sec/2014/q2/280

Comment 1 Vincent Danen 2014-05-09 21:15:17 UTC

Created dovecot tracking bugs for this issue:

Affects: fedora-all [bug 1096408]

Comment 2 Orion Poplawski 2014-05-13 20:54:38 UTC

Is there going to be an update for the RHEL package?

Comment 3 Fedora Update System 2014-05-18 22:56:44 UTC

dovecot-2.2.13-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-06-17 23:38:22 UTC

dovecot-2.2.13-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 errata-xmlrpc 2014-06-25 15:41:21 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2014:0790 https://rhn.redhat.com/errata/RHSA-2014-0790.html

Comment 11 Vincent Danen 2014-06-25 17:43:22 UTC

Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.