Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 11.04 USN-1143-1 Critical: Dovecot Denial of Service Issue

ubuntu
Calendar Grey June 2, 2011
Scroller Ubuntu
An intruder might compromise messaging systems via specially designed emails aimed at Postfix. Critical patches now accessible.
An attacker could send a crafted email message that could disrupt emailservice.

Summary

An attacker could send a crafted email message that could disrupt email

service.

Software Description:

- dovecot: IMAP and POP3 email server

Details:

It was discovered that the message header parser in Dovecot did not

properly handle '\0' characters in header names. This could allow a

remote attacker to cause a denial of service through a crafted email

message by crashing the Dovecot daemon or corrupting mailboxes.

Topics%20covered

Topics Covered

security advisory denial of service ubuntu dovecot email disruption

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  dovecot-common                  1:1.2.15-3ubuntu2.1

Ubuntu 10.10:
  dovecot-common                  1:1.2.12-1ubuntu8.2

Ubuntu 10.04 LTS:
  dovecot-common                  1:1.2.9-1ubuntu6.4

In general, a standard system update will make all the necessary changes.

References

CVE-2011-1929

Severity
critical
Lowest
Low
Medium
High
Critical

June 02, 2011

Topics%20covered

Topics Covered

security advisory denial of service ubuntu dovecot email disruption

Package Information

https://launchpad.net/ubuntu/+source/dovecot/1:1.2.15-3ubuntu2.1
https://launchpad.net/ubuntu/+source/dovecot/1:1.2.12-1ubuntu8.2
https://launchpad.net/ubuntu/+source/dovecot/1:1.2.9-1ubuntu6.4

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.