Resource exhaustion in Dovecot - CVE-2017-2669
Published: April 10, 2017 / Updated: November 28, 2018
Vulnerability identifier: #VU16153
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-2669
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform denial of service (DoS)M attack.
The vulnerability exists due to the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion when 'dict' passdb and userdb were used for user authentication. A remote attacker can send specially crafted %variable fields, use excessive memory and cause the process to crash.
Affected software
Dovecot
Arch Linux
Fedora
dovecot (Ubuntu package)
dovecot
Arch Linux
Fedora
dovecot (Ubuntu package)
dovecot
How to mitigate CVE-2017-2669
Update to version 2.2.29.
Dovecot - update to 2.2.29
dovecot (Ubuntu package) - addressed in versions 1:2.2.22-1ubuntu2.3, 1:2.2.24-1ubuntu1.2
dovecot - addressed in versions 2.2.29.1-1.fc24, 2.2.29.1-1.fc25, 2.2.29.1-1.fc26
dovecot (Ubuntu package) - addressed in versions 1:2.2.22-1ubuntu2.3, 1:2.2.24-1ubuntu1.2
dovecot - addressed in versions 2.2.29.1-1.fc24, 2.2.29.1-1.fc25, 2.2.29.1-1.fc26