In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0115 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-11500:
    In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing     can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-     bounds writes and remote code execution.

    CVE-2019-3814:
    It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users.

    CVE-2020-10957:
    In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a     NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

    CVE-2020-10958:
    In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in     submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines     after a command.

    CVE-2020-10967:
    In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by     sending mail with an empty localpart.

    CVE-2020-12100:
    In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to     cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME     parts.

    CVE-2020-12673:
    In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because     of an out-of-bounds read.

    CVE-2020-12674:
    In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because     a length of zero is mishandled.

    CVE-2020-24386:
    An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can     trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages     (and path disclosure).

    CVE-2020-25275:
    Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application     crash via a crafted email message with certain choices for ten thousand MIME parts.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0115 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-11500:
    In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing     can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-     bounds writes and remote code execution.

    CVE-2019-3814:
    It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users.

    CVE-2020-10957:
    In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a     NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

    CVE-2020-10958:
    In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in     submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines     after a command.

    CVE-2020-10967:
    In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by     sending mail with an empty localpart.

    CVE-2020-12100:
    In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to     cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME     parts.

    CVE-2020-12673:
    In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because     of an out-of-bounds read.

    CVE-2020-12674:
    In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because     a length of zero is mishandled.

    CVE-2020-24386:
    An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can     trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages     (and path disclosure).

    CVE-2020-25275:
    Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application     crash via a crafted email message with certain choices for ten thousand MIME parts.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in
    command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.
    (CVE-2020-7046)

  - The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many
    characters must be read to compute the snippet and a trailing > character exists. This causes a denial of
    service in which the recipient cannot read all of their messages. (CVE-2020-7957)

  - In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a
    NULL Pointer Dereference and crash in submission-login, submission, or lmtp. (CVE-2020-10957)

  - In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in
    submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines
    after a command. (CVE-2020-10958)

  - In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by
    sending mail with an empty localpart. (CVE-2020-10967)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a
    NULL Pointer Dereference and crash in submission-login, submission, or lmtp. (CVE-2020-10957)

  - In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in
    submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines
    after a command. (CVE-2020-10958)

  - In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by
    sending mail with an empty localpart. (CVE-2020-10967)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:2901 advisory.

  - dovecot: malformed NOOP commands leads to DoS (CVE-2020-10957)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Dovecot before 2.3.10.1, unauthenticated sending of     malformed parameters to a NOOP command causes a NULL     Pointer Dereference and crash in submission-login,     submission, or lmtp.(CVE-2020-10957)

  - In Dovecot before 2.3.10.1, remote unauthenticated     attackers can crash the lmtp or submission process by     sending mail with an empty localpart.(CVE-2020-10967)

  - In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message     triggers an unauthenticated use-after-free bug in     submission-login, submission, or lmtp, and can lead to     a crash under circumstances involving many newlines     after a command.(CVE-2020-10958)

  - lib-smtp in submission-login and lmtp in Dovecot 2.3.9     before 2.3.9.3 mishandles truncated UTF-8 data in     command parameters, as demonstrated by the     unauthenticated triggering of a submission-login     infinite loop.(CVE-2020-7046)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-2901 advisory.

    [1:2.3.8-2.1]
    - fix CVE-2020-10957: malformed NOOP commands leads to DoS (#1840353)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2901 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: malformed NOOP commands leads to DoS (CVE-2020-10957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for dovecot23 to 2.3.10 fixes the following issues :

Security issues fixed :

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).

CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).

CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed :

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot23 fixes the following issues :

Security issues fixed :

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).

CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).

CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed :

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2020-10957: lmtp/submission: A client can crash the     server by sending a NOOP command with an invalid string     parameter. This occurs particularly for a parameter that     doesn't start with a double quote. This applies to all     SMTP services, including submission-login, which makes     it possible to crash the submission service without     authentication.

  - CVE-2020-10958: lmtp/submission: Sending many invalid or     unknown commands can cause the server to access freed     memory, which can lead to a server crash. This happens     when the server closes the connection with a '421 Too     many invalid commands' error. The bad command limit     depends on the service (lmtp or submission) and varies     between 10 to 20 bad commands.

  - CVE-2020-10967: lmtp/submission: Issuing the RCPT     command with an address that has the empty quoted string     as local-part causes the lmtp service to crash.

----

dovecot updated to 2.3.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot23 to 2.3.10 fixes the following issues :

Security issues fixed :

  - CVE-2020-10957: Fixed a crash caused by malformed NOOP     commands (bsc#1171457).

  - CVE-2020-10958: Fixed a use-after-free when receiving     too many newlines (bsc#1171458).

  - CVE-2020-10967: Fixed a crash in the lmtp and submission     components caused by mails with empty quoted localparts     (bsc#1171456).

Non-security issues fixed :

  - The update to 2.3.10 fixes several bugs. Please refer to     https://dovecot.org/doc/NEWS for a complete list of     changes.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

- CVE-2020-10957: lmtp/submission: A client can crash the     server by sending a NOOP command with an invalid string     parameter. This occurs particularly for a parameter that     doesn't start with a double quote. This applies to all     SMTP services, including submission-login, which makes     it possible to crash the submission service without     authentication.

  - CVE-2020-10958: lmtp/submission: Sending many invalid or     unknown commands can cause the server to access freed     memory, which can lead to a server crash. This happens     when the server closes the connection with a '421 Too     many invalid commands' error. The bad command limit     depends on the service (lmtp or submission) and varies     between 10 to 20 bad commands.

  - CVE-2020-10967: lmtp/submission: Issuing the RCPT     command with an address that has the empty quoted string     as local-part causes the lmtp service to crash.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Dovecot email server, which could cause crashes in the submission, submission-login or lmtp services, resulting in denial of service.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4361-1 advisory.

    Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use     this issue to cause a denial of service. (CVE-2020-10957, CVE-2020-10967)

    Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use     this issue to cause a denial of service or execute arbitrary code. (CVE-2020-10958)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Aki Tuomi reports :

Vulnerability Details : Sending malformed NOOP command causes crash in submission, submission-login or lmtp service.

Risk : Remote attacker can keep submission-login service down, causing denial of service attack. For lmtp the risk is neglible, as lmtp is usually behind a trusted MTA.

Steps to reproduce : Send ``NOOP EE'FY`` to submission port, or similarly malformed command.

Vulnerability Details :

Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submission or lmtp service.

Risk :

Remote attacker can keep submission-login service down, causing denial of service attack. For lmtp the risk is neglible, as lmtp is usually behind a trusted MTA.

Steps to reproduce :

This can be currently reproduced with ASAN or Valgrind. Reliable way to crash has not yet been discovered.

Vulnerability Details : Sending mail with empty quoted localpart causes submission or lmtp component to crash.

Risk : Malicious actor can cause denial of service to mail delivery by repeatedly sending mails with bad sender or recipient address.

Steps to reproduce : Send mail with envelope sender or recipient as <''@example.org>.

Workaround : For submission there is no workaround, but triggering the bug requires valid credentials. For lmtp, one can implement sufficient filtering on MTA level to prevent mails with such addresses from ending up in LMTP delivery.

ID	Name	Product	Family	Type	Severity
239574	TencentOS Server 3: dovecot (TSSA-2022:0115)	Nessus	Tencent Local Security Checks	Local	critical
236418	Alibaba Cloud Linux 3 : 0115: dovecot (ALINUX3-SA-2022:0115)	Nessus	Alibaba Cloud Linux Local Security Checks	Local	critical
423863	Alpine: multiple dovecot packages: security update to 2.3.10.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
423863	Alpine: multiple dovecot packages: security update to 2.3.10.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
400386	Alpine: multiple dovecot packages: security update to 2.3.10-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
400386	Alpine: multiple dovecot packages: security update to 2.3.10-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
145870	CentOS 8 : dovecot (CESA-2020:2901)	Nessus	CentOS Local Security Checks	Local	high
139946	EulerOS 2.0 SP8 : dovecot (EulerOS-SA-2020-1843)	Nessus	Huawei Local Security Checks	Local	high
138485	Oracle Linux 8 : dovecot (ELSA-2020-2901)	Nessus	Oracle Linux Local Security Checks	Local	high
138388	RHEL 8 : dovecot (RHSA-2020:2901)	Nessus	Red Hat Local Security Checks	Local	high
137536	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2020:1380-1)	Nessus	SuSE Local Security Checks	Local	high
137535	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2020:1379-1)	Nessus	SuSE Local Security Checks	Local	high
137106	Fedora 32 : 1:dovecot (2020-1dee17d880)	Nessus	Fedora Local Security Checks	Local	high
136961	openSUSE Security Update : dovecot23 (openSUSE-2020-720)	Nessus	SuSE Local Security Checks	Local	high
136938	Fedora 31 : 1:dovecot (2020-b60344c987)	Nessus	Fedora Local Security Checks	Local	high
136754	Debian DSA-4690-1 : dovecot - security update	Nessus	Debian Local Security Checks	Local	high
136708	Ubuntu 20.04 LTS : Dovecot vulnerabilities (USN-4361-1)	Nessus	Ubuntu Local Security Checks	Local	high
136706	FreeBSD : Dovecot -- Multiple vulnerabilities (37d106a8-15a4-483e-8247-fcb68b16eaf8)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2020-10957

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high