Bug 1096402 (CVE-2014-3430) - CVE-2014-3430 dovecot: denial of service through maxxing out SSL connections
Summary: CVE-2014-3430 dovecot: denial of service through maxxing out SSL connections
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-3430
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1096408 1108001 1108002 1108003 1108004 1700473
Blocks: 1096403
TreeView+ depends on / blocked
 
Reported: 2014-05-09 20:49 UTC by Vincent Danen
Modified: 2021-02-17 06:34 UTC (History)
7 users (show)

Fixed In Version: dovecot 2.2.13
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-25 17:43:22 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1111486 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Bugzilla 1111487 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Product Errata RHSA-2014:0790 0 normal SHIPPED_LIVE Moderate: dovecot security update 2014-06-25 19:39:46 UTC

Internal Links: 1111486 1111487

Description Vincent Danen 2014-05-09 20:49:35 UTC
As reported on oss-sec [1]:

There's an upper limit to how many IMAP/POP3 connections can exist that haven't logged in (and separate
limits for post-login). Normally when this limit is reached, the oldest connection gets disconnected.
There is of course some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections, but because
the oldest connection always gets destroyed this requires quite a lot of activity from the attacker.

This "destroy oldest connection" however hasn't been working in v1.1+ releases for connections that have
started SSL/TLS handshake, but haven't finished it. So an attacker could just do a bunch of TCP
connections to port 993 and leave them hanging around and Dovecot would pretty quickly reach the upper
limit without being able to disconnect any of the oldest connections.

Here are patches to fix this:

http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3
http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339
http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc
http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b
http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c

The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For older releases you need to
patch it yourself.

For people who are using dovecot-ee releases the fix is also in v2.2.12.12 and v2.1.7.7 releases.


[1] http://seclists.org/oss-sec/2014/q2/280

Comment 1 Vincent Danen 2014-05-09 21:15:17 UTC
Created dovecot tracking bugs for this issue:

Affects: fedora-all [bug 1096408]

Comment 2 Orion Poplawski 2014-05-13 20:54:38 UTC
Is there going to be an update for the RHEL package?

Comment 3 Fedora Update System 2014-05-18 22:56:44 UTC
dovecot-2.2.13-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-06-17 23:38:22 UTC
dovecot-2.2.13-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 errata-xmlrpc 2014-06-25 15:41:21 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2014:0790 https://rhn.redhat.com/errata/RHSA-2014-0790.html

Comment 11 Vincent Danen 2014-06-25 17:43:22 UTC
Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.


Note You need to log in before you can comment on or make changes to this bug.