Red Hat Bugzilla – Bug 1549483
CVE-2017-14461 dovecot: Information Leak Vulnerability in rfc822_parse_domain leading to denial-of-service
Last modified: 2018-08-31 17:54:03 EDT
An information leak vulnerability in rfc822_parse_domain was found in dovecot, affecting versions 2.0 - 2.2.33 and 2.3.0. A malicious party can send a specially crafted email to a vulnerable system, causing it to crash dovecot. In some systems, the mail can be stored into the mail system, causing crash every time it is being opened. If the mail is stored into the mail system, it can be used to also leak heap memory from IMAP process by requesting bodystructure of the mail.
Created attachment 1401224 [details] Upstream patch #1
Created attachment 1401225 [details] Upstream patch #2
Created attachment 1401226 [details] Upstream patch #3
Created attachment 1401227 [details] Upstream patch #4
Created attachment 1401228 [details] Upstream patch #5
Created attachment 1401229 [details] Upstream patch #6
Created attachment 1401230 [details] Upstream patch #7
Reference: http://www.openwall.com/lists/oss-security/2018/03/01/2
Created dovecot tracking bugs for this issue: Affects: fedora-all [bug 1550508]
Acknowledgments: Name: the Dovecot project Upstream: Aleksandar Nikolic (Cisco Talos), flxflndy
External References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0510 https://www.dovecot.org/list/dovecot-news/2018-February/000370.html