Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.

+ quota: Add plugin { quota_max_mail_size } setting to     limit the maximum individual mail size that can be     saved.

  + imapc: Add imapc_features=delay-login. If set,     connecting to the remote IMAP server isn't done until     it's necessary.

  + imapc: Add imapc_connection_retry_count and     imapc_connection_retry_interval settings.

  + imap, pop3, indexer-worker: Add (deinit) to process     title before autoexpunging runs.

  + Added %{encrypt} and %{decrypt} variables

  + imap/pop3 proxy: Log proxy state in errors as     human-readable string.

  + imap/pop3-login: All forward_* extra fields returned by     passdb are sent to the next hop when proxying using     ID/XCLIENT commands. On the receiving side these fields     are imported and sent to auth process where they're     accessible via %{passdb:forward_*}. This is done only if     the sending IP address matches login_trusted_networks.

  + imap-login: If imap_id_retain=yes, send the IMAP ID     string to auth process. %{client_id} expands to it in     auth process. The ID string is also sent to the next hop     when proxying.

  + passdb imap: Use ssl_client_ca_* settings for CA     validation.

  - fts-tika: Fixed crash when parsing attachment without     Content-Disposition header. Broken by 2.2.28.

  - trash plugin was broken in 2.2.28

  - auth: When passdb/userdb lookups were done via     auth-workers, too much data was added to auth cache.
    This could have resulted in wrong replies when using     multiple passdbs/userdbs.

  - auth: passdb { skip & mechanisms } were ignored for the     first passdb

  - oauth2: Various fixes, including fixes to crashes

  - dsync: Large Sieve scripts (or other large metadata)     weren't always synced.

  - Index rebuild (e.g. doveadm force-resync) set all mails     as \Recent

  - imap-hibernate: %{userdb:*} wasn't expanded in     mail_log_prefix

  - doveadm: Exit codes weren't preserved when proxying     commands via doveadm-server. Almost all errors used exit     code 75 (tempfail).

  - ACLs weren't applied to not-yet-existing autocreated     mailboxes.

  - Fixed a potential crash when parsing a broken message     header.

  - cassandra: Fallback consistency settings weren't working     correctly.

  - doveadm director status <user>: 'Initial config' was     always empty

  - imapc: Various reconnection fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot22 to version 2.2.30.2 fixes the following issues :

This security issue was fixed :

  - CVE-2017-2669: Don't double-expand %variables in keys.
    If dict was used as the authentication passdb, using     specially crafted %variables in the username could be     used to cause DoS (bsc#1032248)

Additionally stronger SSL default ciphers are now used.

This non-security issue was fixed :

  - Remove all references /etc/ssl/certs/. It should not be     used anymore (bsc#932386)

The version 2.2.30.2 also includes many fixes and enhancements :

  - Multiple failed authentications within short time caused     crashes.

  - Use timing safe comparisons for everything related to     passwords.

  - Master process now sends SIGQUIT to all running children     at shutdown, which instructs them to close all the     socket listeners immediately. Restarting Dovecot should     no longer fail due to some processes keeping the     listeners open for a long time.

  - Add passdb ( mechanisms=none ) to match separate passdb     lookup.

  - Add passdb ( username_filter ) to use passdb only if     user matches the filter.

  - Add dsync_commit_msgs_interval setting. It attempts to     commit the transaction after saving this many new     messages.

  - Support imapc_features=search without ESEARCH extension.

  - Add imapc_features=fetch-bodystructure to pass through     remote server's FETCH BODY and BODYSTRUCTURE.

  - Add quota=imapc backend to use GETQUOTA/GETQUOTAROOT on     the remote server.

  - Add allow_invalid_cert and ssl_ca_file parameters.

  - If dovecot.index.cache corruption is detected, reset     only the one corrupted mail instead of the whole file.

  - Add 'firstsaved' field to doveadm mailbox status.

  - Add old host's up/down and vhost count as parameters to     director_flush_socket.

  - More fixes to automatically fix corruption in     dovecot.list.index.

  - Fix support for dsync_features=empty-header-workaround.

  - IMAP NOTIFY wasn't working for non-INBOX if IMAP client     hadn't enabled modseq tracking via CONDSTORE/QRESYNC.

  - Fix fts-lucene it to work again with mbox format.

  - Some internal error messages may have contained garbage     in v2.2.29.

  - Re-encrypt when copying/moving mails and per-mailbox     keys are used, otherwise the copied mails can't be     opened.

This update was imported from the SUSE:SLE-12:Update update project.

This update for dovecot22 to version 2.2.29.1 fixes the following issues: This security issue was fixed :

  - CVE-2017-2669: Don't double-expand %variables in keys.
    If dict was used as the authentication passdb, using     specially crafted %variables in the username could be     used to cause DoS (bsc#1032248) Additionally stronger     SSL default ciphers are now used.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Timo Sirainen reports :

passdb/userdb dict: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3258-2 advisory.

    USN-3258-1 intended to fix a vulnerability in Dovecot. Further investigation revealed that only Dovecot     versions 2.2.26 and newer were affected by the vulnerability. Additionally, the change introduced a     regression when Dovecot was configured to use the dict authentication database. This update reverts the     change. We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that the Dovecot email server is vulnerable to a denial of service attack. When the 'dict' passdb and userdb are used for user authentication, the username sent by the IMAP/POP3 client is sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart).

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3258-1 advisory.

    It was discovered that Dovecot incorrectly handled some usernames. An attacker could possibly use this     issue to cause Dovecot to hang or crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
101742	Fedora 26 : 1:dovecot (2017-e8b639c286)	Nessus	Fedora Local Security Checks	Local	high
101284	openSUSE Security Update : dovecot22 (openSUSE-2017-787)	Nessus	SuSE Local Security Checks	Local	high
100152	SUSE SLES12 Security Update : dovecot22 (SUSE-SU-2017:1250-1)	Nessus	SuSE Local Security Checks	Local	high
99750	FreeBSD : dovecot -- Dovecot DoS when passdb dict was used for authentication (a8c8001b-216c-11e7-80aa-005056925db4)	Nessus	FreeBSD Local Security Checks	Local	high
99721	Fedora 24 : 1:dovecot (2017-da4ed58fd5)	Nessus	Fedora Local Security Checks	Local	high
99697	Fedora 25 : 1:dovecot (2017-6ef28e38d6)	Nessus	Fedora Local Security Checks	Local	high
99303	Ubuntu 16.04 LTS : Dovecot regression (USN-3258-2)	Nessus	Ubuntu Local Security Checks	Local	high
99292	Debian DSA-3828-1 : dovecot - security update	Nessus	Debian Local Security Checks	Local	high
99279	Ubuntu 16.04 LTS : Dovecot vulnerability (USN-3258-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2017-2669

high

Tenable Plugins

high

high

high

high

high

high

high

high

high