dovecot - May 2014 - Denial of Service attacks against Dovecot v1.1+

There's an upper limit to how many IMAP/POP3 connections can exist that
haven't logged in (and separate limits for post-login). Normally when this
limit is reached, the oldest connection gets disconnected. There is of course
some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections,
but because the oldest connection always gets destroyed this requires quite a
lot of activity from the attacker.

This "destroy oldest connection" however hasn't been working in
v1.1+ releases for connections that have started SSL/TLS handshake, but
haven't finished it. So an attacker could just do a bunch of TCP connections
to port 993 and leave them hanging around and Dovecot would pretty quickly reach
the upper limit without being able to disconnect any of the oldest connections.

Here are patches to fix this:

http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3
http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339
http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc
http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b
http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c

The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For
older releases you need to patch it yourself.

For people who are using dovecot-ee releases the fix is also in v2.2.12.12 and
v2.1.7.7 releases.

Am 08.05.2014 17:29, schrieb Timo Sirainen:
> There's an upper limit to how many IMAP/POP3 connections can exist that
haven't logged in (and separate limits for post-login). Normally when this
limit is reached, the oldest connection gets disconnected. There is of course
some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections,
but because the oldest connection always gets destroyed this requires quite a
lot of activity from the attacker.
> 
> This "destroy oldest connection" however hasn't been working
in v1.1+ releases for connections that have started SSL/TLS handshake, but
haven't finished it. So an attacker could just do a bunch of TCP connections
to port 993 and leave them hanging around and Dovecot would pretty quickly reach
the upper limit without being able to disconnect any of the oldest connections.
> 
> Here are patches to fix this:
> 
> http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3
> http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339
> http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc
> http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b
> http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c
> 
> The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release
it.
my vote for 2.1.18 , 2.1.x is still widly used


For older releases you need to patch it yourself.
> 
> For people who are using dovecot-ee releases the fix is also in v2.2.12.12
and v2.1.7.7 releases.
> 


Best Regards
MfG Robert Schetterer

-- 
[*] sys4 AG

http://sys4.de, +49 (89) 30 90 46 64
Franziskanerstra?e 15, 81669 M?nchen

Sitz der Gesellschaft: M?nchen, Amtsgericht M?nchen: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

On Thu, May 08, 2014 at 06:29:27PM +0300, Timo Sirainen
wrote:
> There's an upper limit to how many IMAP/POP3 connections can exist that
haven't logged in (and separate limits for post-login). Normally when this
limit is reached, the oldest connection gets disconnected. There is of course
some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections,
but because the oldest connection always gets destroyed this requires quite a
lot of activity from the attacker.
> 
> This "destroy oldest connection" however hasn't been working
in v1.1+ releases for connections that have started SSL/TLS handshake, but
haven't finished it. So an attacker could just do a bunch of TCP connections
to port 993 and leave them hanging around and Dovecot would pretty quickly reach
the upper limit without being able to disconnect any of the oldest connections.
> 
> Here are patches to fix this:
> 
> http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3
> http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339
> http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc
> http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b
> http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c
> 
> The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release
it. For older releases you need to patch it yourself.
> 
> For people who are using dovecot-ee releases the fix is also in v2.2.12.12
and v2.1.7.7 releases.
Please use CVE-2014-3430 for this issue.

---
Henri Salo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20140510/a034d24c/attachment.sig>