PT-2013-1039 · Dovecot+1 · Dovecot+1

Agostino Sarubbo · Published 2013-05-06 · Updated 2014-05-28 · CVE-2013-2111

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.2.2

Description The issue concerns the IMAP functionality in Dovecot, where an error in the implementation allows remote attackers to cause a denial of service. This can be achieved by sending a specially crafted network packet with an invalid APPEND parameter, which leads to an infinite loop and CPU consumption. The vulnerable component is related to the /imap/cmd-append.c file.

Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the IMAP functionality to minimize the risk of exploitation. Avoid using the APPEND parameter in the affected IMAP endpoint until the issue is resolved.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2013-1002

BDU:2015-00047

CVE-2013-2111

Affected Products

Alt Linux

Dovecot

References · 13

• https://cve.org/CVERecord?id=CVE-2013-2111 · Security Note
• http://dovecot.org/list/dovecot-news/2013-May/000255.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00047 · Security Note
• https://errata.altlinux.org/ALT-PU-2013-1002 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2111 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2111 · Security Note
• https://ubuntu.com/security/CVE-2013-2111 · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/05/22/8 · Note
• http://securitytracker.com/id/1028585 · Note
• http://openwall.com/lists/oss-security/2013/05/24/1 · Note
• http://secunia.com/advisories/53492 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2013-2111 · Note