Bug 966029 (CVE-2013-2111)

Summary:	CVE-2013-2111 dovecot: DoS (daemon hang) when parsing invalid IMAP APPEND command parameters
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	janfrode, mhlavink
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dovecot-2.2.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-05-24 11:31:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	966032

Description Jan Lieskovsky 2013-05-22 10:04:52 UTC

A denial of service flaw was found in the way IMAP command parser of Dovecot, IMAP and POP3 server, processed certain parameters of the IMAP APPEND command. A remote authenticated user could issue a specially-crafted IMAP APPEND command that, when processed would lead to dovecot daemon hang (infinite loop).

References:
[1] http://www.dovecot.org/list/dovecot-news/2013-May/000255.html
[2] http://www.openwall.com/lists/oss-security/2013/05/21/2
[3] https://secunia.com/advisories/53492/

Relevant upstream patch:
[4] http://hg.dovecot.org/dovecot-2.2/rev/ea0390e1789f

Comment 1 Jan Lieskovsky 2013-05-22 10:08:58 UTC

This issue did NOT affect the versions of the dovecot package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue did NOT affect the versions of the dovecot package, as shipped with Fedora release of 17 and 18.

--

This issue did NOT affect the version of the dovecot package, as shipped with Fedora Rawhide (an update including the fix has been already created).

Comment 2 Huzaifa S. Sidhpurwala 2013-05-22 11:05:44 UTC

Statement:

Not Vulnerable. This issue does not affect the version of dovecot as shipped with Red Hat Enterprise Linux 5 and 6.