PT-2017-15466 · Dovecot+3 · Dovecot+3
Publicado
2017-04-10
·
Atualizado
2019-10-09
·
CVE-2017-2669
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Dovecot versions prior to 2.2.29
Description
The issue allows for a denial of service when 'dict' passdb and userdb are used for user authentication. By sending specially crafted %variable fields, an attacker can cause excessive memory usage, leading to a process crash and restart, or excessive CPU usage, causing all authentications to hang.
Recommendations
For versions prior to 2.2.29, update to version 2.2.29 or later to resolve the issue. As a temporary workaround, consider restricting the use of 'dict' passdb and userdb for user authentication until a patch is available. Avoid using variable expansion in the username sent by the IMAP/POP3 client to minimize the risk of exploitation.
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Dovecot
Suse
Ubuntu