Dovecot up to 2.3.10.1 NTLM Request out-of-bounds

Summaryinfo

A vulnerability was found in Dovecot and classified as problematic. Affected by this issue is some unknown functionality of the component NTLM Handler. Executing a manipulation as part of Request can lead to out-of-bounds. This vulnerability appears as CVE-2020-12673. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Dovecot (Mail Server Software). This vulnerability affects an unknown code of the component NTLM Handler. The manipulation as part of a Request leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. CVE summarizes:

In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.

The weakness was presented 08/12/2020 (oss-sec). The advisory is shared for download at openwall.com. This vulnerability was named CVE-2020-12673 since 05/06/2020. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 334524 (Oracle Linux 7 : dovecot (ELSA-2026-26564)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.3.11.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (334524). See VDB-159689 and VDB-159687 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Mail Server Software

Name

• Dovecot

Version

• 0.99.13
• 0.99.14
• 1.0
• 1.0 Beta2
• 1.0 Beta3
• 1.0 Beta7
• 1.0 Rc29
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.12
• 1.0.beta2
• 1.0.beta3
• 1.0.beta7
• 1.0.beta8
• 1.0.rc1
• 1.0.rc2
• 1.0.rc3
• 1.0.rc4
• 1.0.rc5
• 1.0.rc6
• 1.0.rc7
• 1.0.rc8
• 1.0.rc9
• 1.0.rc10
• 1.0.rc11
• 1.0.rc12
• 1.0.rc13
• 1.0.rc14
• 1.0.rc15
• 1.0.rc29
• 1.0beta2
• 1.0beta3
• 1.1
• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.1
• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.10
• 2.1.11
• 2.1.12
• 2.1.13
• 2.1.14
• 2.1.15
• 2.2
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.13
• 2.2.17
• 2.2.27
• 2.2.29
• 2.2.34
• 2.2.36.1
• 2.2.36.3
• 2.2.36.4
• 2.3.0
• 2.3.4.0
• 2.3.4.1
• 2.3.5.0
• 2.3.5.1
• 2.3.5.2
• 2.3.7.1
• 2.3.7.2
• 2.3.9.0
• 2.3.9.1
• 2.3.9.2
• 2.3.9.3
• 2.3.10.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion