Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11)

[Vincent Danen <vdanen () redhat com>]

* [2012-12-04 23:01:42 +0100] Moritz Muehlenhoff wrote:

> On Tue, Dec 04, 2012 at 06:12:29PM +0100, Matthias Weckbecker wrote:
> > Hi Kurt, Vincent, vendors, ...
> >
> > Quoting Kurt Seifried <kseifried () redhat com>:
> > >-----BEGIN PGP SIGNED MESSAGE-----
> > >Hash: SHA1
> > >
> > >On 12/03/2012 10:33 AM, Vincent Danen wrote:
> > >>Could a CVE be assigned for the following please?
> > >>
> > >>Dovecot 2.1.11 was released and includes a fix for a crash
> > >>condition when the IMAP server was issued a SEARCH command with
> > >>multiple KEYWORD parameters.  An authenticated remote user could
> > >>use this flaw to crash Dovecot.
> > >>
> > [...]
> > >>
> > >>
> > >>Thanks.
> > >
> > >Please use CVE-2012-5620 for this issue.
> > >
> >
> > We were discussing this issue too at [1] and think that it does only
> > affect the current connection, no subsequent (i.e. new) connections
> > are affected.
> >
> > What's your opinion wrt this?
> >
> > [1] https://bugzilla.novell.com/show_bug.cgi?id=792642
>
> Upstream (Timo Sirainen) disputed the issue in the Debian BTS:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15

Ahhh... yes, Timo is correct.  If you're only DoS'ing your own
connection, I wouldn't consider this a flaw.

I (mistakenly) thought this took down the entire dovecot server.  My
apologies.

Can we have this CVE rejected or disputed?  As Timo says, it's a
pointless CVE.

Thanks, and sorry about that.

--
Vincent Danen / Red Hat Security Response Team