PT-2011-3483 · Dovecot+1 · Dovecot+1

Vincent Danen · Published 2011-05-24 · Updated 2017-08-17 · CVE-2011-1929

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Dovecot versions 1.2.x through 1.2.16 Dovecot versions 2.0.x through 2.0.12

Description The issue allows remote attackers to cause a denial of service, potentially leading to daemon crash or mailbox corruption, by sending a crafted e-mail message that exploits improper handling of '0' characters in header names.

Recommendations For Dovecot versions 1.2.x through 1.2.16, update to version 1.2.17 or later. For Dovecot versions 2.0.x through 2.0.12, update to version 2.0.13 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-1929

DSA-2252-1

RHSA-2011:1187

RHSA-2011_1187

Affected Products

Dovecot

Red Hat

References · 32

• https://bugzilla.redhat.com/show_bug.cgi?id=706286 · Patch
• https://hermes.opensuse.org/messages/8581790 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1929 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-1187.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061384.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-1187.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-1929 · Vendor Advisory
• http://ubuntu.com/usn/USN-1143-1 · Vendor Advisory
• http://dovecot.org/pipermail/dovecot/2011-May/059086.html · Patch
• http://openwall.com/lists/oss-security/2011/05/19/6 · Patch
• http://dovecot.org/pipermail/dovecot/2011-May/059085.html · Patch
• http://openwall.com/lists/oss-security/2011/05/18/4 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1929 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060825.html · Vendor Advisory