CVE-2020-12673

In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.

In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.

• CVE-2020-12673: fix reading past buffer

• CVE-2020-12673: fix reading past buffer

CVE-2020-12100: Receiving mail with deeply nested MIME parts leads to resource exhaustion as Dovecot attempts to parse it. CVE-2020-12673: Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash. CVE-2020-12674: Dovecot's RPA mechanism implementation accepts zero-length message, which leads to assert-crash later on.

This update for dovecot23 fixes the following issues:

• CVE-2020-12673: improper implementation of NTLM does not check message buffer size (bsc#1174922).
• CVE-2020-12674: improper implementation of RPA mechanism (bsc#1174923).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for dovecot23 fixes the following issues:

• CVE-2020-12673: improper implementation of NTLM does not check message buffer size (bsc#1174922).
• CVE-2020-12674: improper implementation of RPA mechanism (bsc#1174923).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for dovecot23 fixes the following issues:

• CVE-2020-12673: improper implementation of NTLM does not check message buffer size (bsc#1174922).
• CVE-2020-12674: improper implementation of RPA mechanism (bsc#1174923).

This update for dovecot23 fixes the following issues:

• CVE-2020-12673: improper implementation of NTLM does not check message buffer size (bsc#1174922).
• CVE-2020-12674: improper implementation of RPA mechanism (bsc#1174923).

This update for dovecot22 fixes the following issues:

• CVE-2020-12673: improper implementation of NTLM does not check message buffer size (bsc#1174922).
• CVE-2020-12674: improper implementation of RPA mechanism (bsc#1174923).

This update for dovecot23 fixes the following issues:

Security issues fixed:

• CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920).
• CVE-2020-12673: Fixed an improper implementation of NTLM that did not check the message buffer size (bsc#1174922).
• CVE-2020-12674: Fixed an improper implementation of the RPA mechanism (bsc#1174923).
• CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405).
• CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406).

Non-security issues fixed:

• Pigeonhole was updated to version 0.5.11.
• Dovecot was updated to version 2.3.11.3.

It was discovered that Dovecot incorrectly handled deeply nested MIME parts. A remote attacker could possibly use this issue to cause Dovecot to consume resources, resulting in a denial of service. (CVE-2020-12100)

It was discovered that Dovecot incorrectly handled memory when using NTLM. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2020-12673)

It was discovered that the Dovecot RPA mechanism incorrectly handled zero-length messages. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2020-12674)

USN-4456-1 fixed several vulnerabilities in Dovecot. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that Dovecot incorrectly handled deeply nested MIME parts. A remote attacker could possibly use this issue to cause Dovecot to consume resources, resulting in a denial of service. (CVE-2020-12100)

It was discovered that Dovecot incorrectly handled memory when using NTLM. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2020-12673)

It was discovered that the Dovecot RPA mechanism incorrectly handled zero-length messages. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2020-12674)