CVE-2021-33515: Dovecot SMTP Submission service STARTTLS injection.

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
CVE-2021-33515: Dovecot SMTP Submission service STARTTLS injection.

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Aki Tuomi &lt;aki.tuomi () open-xchange com&gt;

Date: Mon, 28 Jun 2021 09:59:59 +0300 (EEST)

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Open-Xchange Security Advisory 2021-06-28

Affected product: Dovecot IMAP Server
Vendor: OX Software GmbH

Internal reference: DOP-2421
Vulnerability type: Cryptographic Issues (CWE-310)
Vulnerable version: 2.3
Vulnerable component: submission
Report confidence: Confirmed
Solution status: Fixed in 2.3.x
Researcher credits: Fabian Ising and Damian Poddebniak of Münster University of Applied Sciences.
Vendor notification: 2021-05-21
CVE reference: CVE-2021-33515
CVSS: 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)

Vulnerability Details:
Dovecot's lib-smtp is vulnerable to STARTTLS command injection. If more commands are pipelined as plaintext after 
STARTTLS, those commands are run inside the TLS session.

Risk:
A MiTM attacker can inject preamble commands to be executed prior to user's commands, these can be used to redirect the 
actual mail and other user commands to attacker controlled address.
Proof of concept script exists.

Solution:
Upgrade to fixed version, or disable STARTTLS support.

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2021-33515: Dovecot SMTP Submission service STARTTLS injection. Aki Tuomi (Jun 28)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->