CVE-2017-15132 Denial of service in dovecot
A memory leak in Dovecot's auth client during SASL aborts can cause process crashes in high-performance configurations, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15132?
CVE-2017-15132 is a high-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 25 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.
Which versions are affected by CVE-2017-15132?
It affects 3 products.
Linux distribution packages (7)
dovecot22 SUSE:Linux Enterprise Server 12 SP2 | All versions | 2.2.31-19.5.1 |
dovecot22 SUSE:Linux Enterprise Server 12 SP3 | All versions | 2.2.31-19.5.1 |
dovecot22 SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 2.2.31-19.5.1 |
dovecot22 SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 2.2.31-19.5.1 |
dovecot22 SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 2.2.31-19.5.1 |
dovecot22 SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 2.2.31-19.5.1 |
dovecot22 SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 2.2.31-19.5.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Dovecot Dovecot.
How do I fix CVE-2017-15132?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-15132 being exploited?
There is no known exploitation of CVE-2017-15132 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2017-15132, CLSA-2026-1777463410, CLSA-2026-1777463708, DEBIAN-CVE-2017-15132, GHSA-f5gc-665w-jv83, MGASA-2018-0114 and 3 more.