CVE-2014-3430

NameCVE-2014-3430
DescriptionDovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service (resource consumption) via an incomplete SSL/TLS handshake for an IMAP/POP3 connection.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDLA-0004-1, DSA-2954-1
NVD severitymedium (attack range: remote)
Debian Bugs747549
Debian/oldoldstablepackage dovecot is vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dovecot (PTS)squeeze, squeeze (security)1:1.2.15-7vulnerable
squeeze (lts)1:1.2.15-7+deb6u1fixed
wheezy, wheezy (security)1:2.1.7-7+deb7u1fixed
stretch, jessie1:2.2.13-11fixed
sid1:2.2.18-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dovecotsource(unstable)1:2.2.13~rc1-1low747549
dovecotsourcesqueeze1:1.2.15-7+deb6u1medium
dovecotsourcewheezy1:2.1.7-7+deb7u1mediumDSA-2954-1

Notes

http://permalink.gmane.org/gmane.mail.imap.dovecot/77499

Search for package or bug name: Reporting problems