In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4763 advisory.

  - In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in     submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines     after a command. (CVE-2020-10958)

  - In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by     sending mail with an empty localpart. (CVE-2020-10967)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has dovecot packages installed that are affected by multiple vulnerabilities:

  - In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in     submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines     after a command. (CVE-2020-10958)

  - In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by     sending mail with an empty localpart. (CVE-2020-10967)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4763 advisory.

  - dovecot: command followed by sufficient number of newlines leads to use-after-free (CVE-2020-10958)

  - dovecot: sending mail with empty quoted localpart leads to DoS (CVE-2020-10967)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4763 advisory.

    - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866756)
    - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866761)
    - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866768)
    - fix CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS (#1840354)
    - fix CVE-2020-10958 dovecot: command followed by sufficient number of newlines       leads to use-after-free (#1840357)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4763 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: command followed by sufficient number of newlines leads to use-after-free (CVE-2020-10958)

    * dovecot: sending mail with empty quoted localpart leads to DoS (CVE-2020-10967)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2020-12100: Parsing mails with a large number of MIME parts could have resulted in excessive CPU usage or a crash due to running out of stack memory. CVE-2020-12673: Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash. CVE-2020-10967: lmtp/submission:
Issuing the RCPT command with an address that has the empty quoted string as local-part causes the lmtp service to crash. CVE-2020-12674:
Dovecot's RPA mechanism implementation accepts zero-length message, which leads to assert-crash later on.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Dovecot before 2.3.10.1, unauthenticated sending of     malformed parameters to a NOOP command causes a NULL     Pointer Dereference and crash in submission-login,     submission, or lmtp.(CVE-2020-10957)

  - In Dovecot before 2.3.10.1, remote unauthenticated     attackers can crash the lmtp or submission process by     sending mail with an empty localpart.(CVE-2020-10967)

  - In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message     triggers an unauthenticated use-after-free bug in     submission-login, submission, or lmtp, and can lead to     a crash under circumstances involving many newlines     after a command.(CVE-2020-10958)

  - lib-smtp in submission-login and lmtp in Dovecot 2.3.9     before 2.3.9.3 mishandles truncated UTF-8 data in     command parameters, as demonstrated by the     unauthenticated triggering of a submission-login     infinite loop.(CVE-2020-7046)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Aki Tuomi reports :

Parsing mails with a large number of MIME parts could have resulted in excessive CPU usage or a crash due to running out of stack memory..

Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash

lmtp/submission: Issuing the RCPT command with an address that has the empty quoted string as local-part causes the lmtp service to crash.

Dovecot's RPA mechanism implementation accepts zero-length message, which leads to assert-crash later on.

This update for dovecot23 to 2.3.10 fixes the following issues :

Security issues fixed :

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).

CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).

CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed :

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot23 fixes the following issues :

Security issues fixed :

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).

CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).

CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed :

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2020-10957: lmtp/submission: A client can crash the     server by sending a NOOP command with an invalid string     parameter. This occurs particularly for a parameter that     doesn't start with a double quote. This applies to all     SMTP services, including submission-login, which makes     it possible to crash the submission service without     authentication.

  - CVE-2020-10958: lmtp/submission: Sending many invalid or     unknown commands can cause the server to access freed     memory, which can lead to a server crash. This happens     when the server closes the connection with a '421 Too     many invalid commands' error. The bad command limit     depends on the service (lmtp or submission) and varies     between 10 to 20 bad commands.

  - CVE-2020-10967: lmtp/submission: Issuing the RCPT     command with an address that has the empty quoted string     as local-part causes the lmtp service to crash.

----

dovecot updated to 2.3.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot23 to 2.3.10 fixes the following issues :

Security issues fixed :

  - CVE-2020-10957: Fixed a crash caused by malformed NOOP     commands (bsc#1171457).

  - CVE-2020-10958: Fixed a use-after-free when receiving     too many newlines (bsc#1171458).

  - CVE-2020-10967: Fixed a crash in the lmtp and submission     components caused by mails with empty quoted localparts     (bsc#1171456).

Non-security issues fixed :

  - The update to 2.3.10 fixes several bugs. Please refer to     https://dovecot.org/doc/NEWS for a complete list of     changes.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

- CVE-2020-10957: lmtp/submission: A client can crash the     server by sending a NOOP command with an invalid string     parameter. This occurs particularly for a parameter that     doesn't start with a double quote. This applies to all     SMTP services, including submission-login, which makes     it possible to crash the submission service without     authentication.

  - CVE-2020-10958: lmtp/submission: Sending many invalid or     unknown commands can cause the server to access freed     memory, which can lead to a server crash. This happens     when the server closes the connection with a '421 Too     many invalid commands' error. The bad command limit     depends on the service (lmtp or submission) and varies     between 10 to 20 bad commands.

  - CVE-2020-10967: lmtp/submission: Issuing the RCPT     command with an address that has the empty quoted string     as local-part causes the lmtp service to crash.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Dovecot email server, which could cause crashes in the submission, submission-login or lmtp services, resulting in denial of service.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4361-1 advisory.

    Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use     this issue to cause a denial of service. (CVE-2020-10957, CVE-2020-10967)

    Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use     this issue to cause a denial of service or execute arbitrary code. (CVE-2020-10958)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Aki Tuomi reports :

Vulnerability Details : Sending malformed NOOP command causes crash in submission, submission-login or lmtp service.

Risk : Remote attacker can keep submission-login service down, causing denial of service attack. For lmtp the risk is neglible, as lmtp is usually behind a trusted MTA.

Steps to reproduce : Send ``NOOP EE'FY`` to submission port, or similarly malformed command.

Vulnerability Details :

Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submission or lmtp service.

Risk :

Remote attacker can keep submission-login service down, causing denial of service attack. For lmtp the risk is neglible, as lmtp is usually behind a trusted MTA.

Steps to reproduce :

This can be currently reproduced with ASAN or Valgrind. Reliable way to crash has not yet been discovered.

Vulnerability Details : Sending mail with empty quoted localpart causes submission or lmtp component to crash.

Risk : Malicious actor can cause denial of service to mail delivery by repeatedly sending mails with bad sender or recipient address.

Steps to reproduce : Send mail with envelope sender or recipient as <''@example.org>.

Workaround : For submission there is no workaround, but triggering the bug requires valid credentials. For lmtp, one can implement sufficient filtering on MTA level to prevent mails with such addresses from ending up in LMTP delivery.

ID	Name	Product	Family	Severity
157639	AlmaLinux 8 : dovecot (ALSA-2020:4763)	Nessus	Alma Linux Local Security Checks	medium
147262	NewStart CGSL MAIN 6.02 : dovecot Multiple Vulnerabilities (NS-SA-2021-0077)	Nessus	NewStart CGSL Local Security Checks	medium
145961	CentOS 8 : dovecot (CESA-2020:4763)	Nessus	CentOS Local Security Checks	medium
142787	Oracle Linux 8 : dovecot (ELSA-2020-4763)	Nessus	Oracle Linux Local Security Checks	medium
142447	RHEL 8 : dovecot (RHSA-2020:4763)	Nessus	Red Hat Local Security Checks	medium
140232	Fedora 31 : 1:dovecot (2020-cd8b8f887b)	Nessus	Fedora Local Security Checks	high
139946	EulerOS 2.0 SP8 : dovecot (EulerOS-SA-2020-1843)	Nessus	Huawei Local Security Checks	high
139589	FreeBSD : mail/dovecot -- multiple vulnerabilities (87a07de1-e55e-4d51-bb64-8d117829a26a)	Nessus	FreeBSD Local Security Checks	high
137536	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2020:1380-1)	Nessus	SuSE Local Security Checks	high
137535	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2020:1379-1)	Nessus	SuSE Local Security Checks	high
137106	Fedora 32 : 1:dovecot (2020-1dee17d880)	Nessus	Fedora Local Security Checks	high
136961	openSUSE Security Update : dovecot23 (openSUSE-2020-720)	Nessus	SuSE Local Security Checks	high
136938	Fedora 31 : 1:dovecot (2020-b60344c987)	Nessus	Fedora Local Security Checks	high
136754	Debian DSA-4690-1 : dovecot - security update	Nessus	Debian Local Security Checks	high
136708	Ubuntu 20.04 LTS : Dovecot vulnerabilities (USN-4361-1)	Nessus	Ubuntu Local Security Checks	high
136706	FreeBSD : Dovecot -- Multiple vulnerabilities (37d106a8-15a4-483e-8247-fcb68b16eaf8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2020-10967

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high