Critical Out-of-Bounds Read Vulnerability in Dovecot Package
Summary
ALPINE-CVE-2020-12673: In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. Affects dovecot versions < 2.3.10.1-r1. Fixed in 2.3.10.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an open-source IMAP and POP3 email server for Unix-like operating systems, designed to provide secure and efficient email retrieval. It is widely used for its performance, flexibility, and support for various authentication methods. However, a critical vulnerability has been identified that affects its stability and security, specifically related to the handling of NTLM requests.
Vulnerability Detail
In Dovecot versions prior to 2.3.11.3, a specially formatted NTLM request can cause the authentication service to crash due to an out-of-bounds read. This vulnerability can be exploited by an attacker to disrupt email services, potentially leading to denial of service. The technical root of the issue lies in improper validation of input data, which allows for unexpected behavior when processing NTLM requests.
How To Fix
Minimum fixed version
2.3.10.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable NTLM authentication in their Dovecot configuration to mitigate the risk of exploitation until the package can be updated. This can be done by modifying the configuration file, usually located at /etc/dovecot/dovecot.conf, and setting the following option: 'auth_ntlm = no'.
Conclusion
The identified out-of-bounds read vulnerability in Dovecot poses a significant risk to email services. It is crucial for users to update their installations to the latest patched versions to ensure security and stability. Temporary workarounds can mitigate risks until updates are applied.
See every vulnerability recorded for dovecot →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Dovecot versions prior to 2.3.11.3 are affected, including versions in Alpine v3.9 to v3.11.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to a denial of service, causing the email server to crash and disrupting email services for users.
Yes, the permanent fix is to update Dovecot to the latest patched version as specified in the 'how to fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
