Bug 1866313 (CVE-2020-12673) - CVE-2020-12673 dovecot: Out of bound reads in dovecot NTLM implementation
Summary: CVE-2020-12673 dovecot: Out of bound reads in dovecot NTLM implementation
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-12673
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1866757 1866758 1866759 1866760 1866761 1868540 1871843
Blocks: 1866310
TreeView+ depends on / blocked
 
Reported: 2020-08-05 10:55 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-16 19:32 UTC (History)
5 users (show)

Fixed In Version: dovecot 2.3.11
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in dovecot. An out-of-bounds read flaw was found in the way dovecot handled NTLM authentication allowing an attacker to crash the dovecot auth process repeatedly preventing login. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2020-09-03 13:17:46 UTC


Attachments (Terms of Use)
Upstream patch (988 bytes, patch)
2020-08-06 03:57 UTC, Huzaifa S. Sidhpurwala
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3617 0 None None None 2020-09-03 10:34:41 UTC
Red Hat Product Errata RHSA-2020:3713 0 None None None 2020-09-10 13:00:02 UTC
Red Hat Product Errata RHSA-2020:3735 0 None None None 2020-09-14 12:42:41 UTC
Red Hat Product Errata RHSA-2020:3736 0 None None None 2020-09-14 12:46:07 UTC

Description Huzaifa S. Sidhpurwala 2020-08-05 10:55:27 UTC
As per upstream:

Vulnerability Details:
Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash.

Risk:
An adversary can use this vulnerability to crash dovecot auth process repeatedly, preventing login.

Comment 2 Huzaifa S. Sidhpurwala 2020-08-06 03:57:39 UTC
Created attachment 1710594 [details]
Upstream patch

Comment 6 Huzaifa S. Sidhpurwala 2020-08-06 09:30:19 UTC
Mitigation:

Upstream suggests that this flaw can be mitigated by disabling NTLM authentication. NTLM authentication can be disabled by using the configuration parameter "auth_mechanisms". More details available at: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/

Comment 7 Huzaifa S. Sidhpurwala 2020-08-06 09:32:55 UTC
Acknowledgments:

Name: the Dovecot project

Comment 8 Huzaifa S. Sidhpurwala 2020-08-13 03:52:46 UTC
External References:

https://dovecot.org/pipermail/dovecot-news/2020-August/000442.html

Comment 9 Huzaifa S. Sidhpurwala 2020-08-13 03:53:21 UTC
Created dovecot tracking bugs for this issue:

Affects: fedora-all [bug 1868540]

Comment 10 Huzaifa S. Sidhpurwala 2020-08-13 04:05:07 UTC
Upstream patch: https://github.com/dovecot/core/commit/fb246611e62ad8c5a95b0ca180a63f17aa34b0d8

Comment 14 errata-xmlrpc 2020-09-03 10:34:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3617 https://access.redhat.com/errata/RHSA-2020:3617

Comment 15 Product Security DevOps Team 2020-09-03 13:17:46 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12673

Comment 20 errata-xmlrpc 2020-09-10 12:59:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3713 https://access.redhat.com/errata/RHSA-2020:3713

Comment 23 errata-xmlrpc 2020-09-14 12:42:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:3735 https://access.redhat.com/errata/RHSA-2020:3735

Comment 24 errata-xmlrpc 2020-09-14 12:46:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3736 https://access.redhat.com/errata/RHSA-2020:3736


Note You need to log in before you can comment on or make changes to this bug.