A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.

Several vulnerabilities have been discovered in the Dovecot email server. The Common Vulnerabilities and Exposures project identifies the following issues :

CVE-2017-14461

Aleksandar Nikolic of Cisco Talos and 'flxflndy' discovered that Dovecot does not properly parse invalid email addresses, which may cause a crash or leak memory contents to an attacker.

CVE-2017-15130

It was discovered that TLS SNI config lookups may lead to excessive memory usage, causing imap-login/pop3-login VSZ limit to be reached and the process restarted, resulting in a denial of service. Only Dovecot configurations containing local_name { } or local { } configuration blocks are affected.

CVE-2017-15132

It was discovered that Dovecot contains a memory leak flaw in the login process on aborted SASL authentication.

For Debian 7 'Wheezy', these problems have been fixed in version 1:2.1.7-7+deb7u2.

We recommend that you upgrade your dovecot packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0.
    An abort of SASL authentication results in a memory     leak in dovecot's auth client used by login processes.
    The leak has impact in high performance configuration     where same login processes are reused and can cause the     process to crash due to memory     exhaustion.(CVE-2017-15132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Dovecot email server. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2017-14461     Aleksandar Nikolic of Cisco Talos and 'flxflndy'     discovered that Dovecot does not properly parse invalid     email addresses, which may cause a crash or leak memory     contents to an attacker.

  - CVE-2017-15130     It was discovered that TLS SNI config lookups may lead     to excessive memory usage, causing imap-login/pop3-login     VSZ limit to be reached and the process restarted,     resulting in a denial of service. Only Dovecot     configurations containing local_name { } or local { }     configuration blocks are affected.

  - CVE-2017-15132     It was discovered that Dovecot contains a memory leak     flaw in the login process on aborted SASL     authentication.

This update for dovecot22 fixes one issue.

This security issue was fixed :

  - CVE-2017-15132: An abort of SASL authentication resulted     in a memory leak in dovecot's auth client used by login     processes. The leak has impact in high performance     configuration where same login processes are reused and     can cause the process to crash due to memory exhaustion     (bsc#1075608).

This update was imported from the SUSE:SLE-12:Update update project.

This update for dovecot22 fixes one issue. This security issue was fixed :

  - CVE-2017-15132: An abort of SASL authentication resulted     in a memory leak in dovecot's auth client used by login     processes. The leak has impact in high performance     configuration where same login processes are reused and     can cause the process to crash due to memory exhaustion     (bsc#1075608).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3556-1 advisory.

    It was discovered that Dovecot incorrectly handled certain authentications. An attacker could possibly use     this to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Pedro Sampaio reports :

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of SASL authentication results in a memory leak in Dovecot auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.

ID	Name	Product	Family	Severity
108767	Debian DLA-1333-1 : dovecot security update	Nessus	Debian Local Security Checks	high
108461	EulerOS 2.0 SP2 : dovecot (EulerOS-SA-2018-1057)	Nessus	Huawei Local Security Checks	high
108460	EulerOS 2.0 SP1 : dovecot (EulerOS-SA-2018-1056)	Nessus	Huawei Local Security Checks	high
107122	Debian DSA-4130-1 : dovecot - security update	Nessus	Debian Local Security Checks	high
106921	openSUSE Security Update : dovecot22 (openSUSE-2018-189)	Nessus	SuSE Local Security Checks	high
106899	SUSE SLES12 Security Update : dovecot22 (SUSE-SU-2018:0466-1)	Nessus	SuSE Local Security Checks	high
106582	Ubuntu 14.04 LTS / 16.04 LTS : Dovecot vulnerability (USN-3556-1)	Nessus	Ubuntu Local Security Checks	high
106426	FreeBSD : dovecot -- abort of SASL authentication results in a memory leak (92b8b284-a3a2-41b1-956c-f9cf8b74f500)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-15132

high

Tenable Plugins

high

high

high

high

high

high

high

high