CVE-2020-10957
📋 TL;DR
CVE-2020-10957 is a NULL pointer dereference vulnerability in Dovecot email server that allows unauthenticated attackers to crash submission-login, submission, or LMTP services by sending malformed parameters to a NOOP command. This affects Dovecot installations before version 2.3.10.1, potentially causing denial of service for email services.
💻 Affected Systems
- Dovecot
📦 What is this software?
Dovecot by Dovecot
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of email submission services, disrupting email delivery and potentially affecting business operations that rely on email communication.
Likely Case
Service crashes requiring manual restart, causing temporary email service disruption until services are restored.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.10.1 and later
Vendor Advisory: https://dovecot.org/security
Restart Required: Yes
Instructions:
1. Backup configuration files. 2. Update Dovecot to version 2.3.10.1 or later using your distribution's package manager. 3. Restart Dovecot services. 4. Verify services are running correctly.
🔧 Temporary Workarounds
Disable vulnerable services
linuxTemporarily disable submission-login, submission, and LMTP services if not required
systemctl stop dovecot-submission
systemctl stop dovecot-lmtp
systemctl disable dovecot-submission
systemctl disable dovecot-lmtp
Network filtering
linuxBlock access to submission (587) and LMTP (24) ports from untrusted networks
iptables -A INPUT -p tcp --dport 587 -j DROP
iptables -A INPUT -p tcp --dport 24 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit access to submission and LMTP services only to trusted sources
- Deploy intrusion detection systems to monitor for exploitation attempts and implement automated service restart scripts
🔍 How to Verify
Check if Vulnerable:
Check Dovecot version with 'dovecot --version' and verify it's below 2.3.10.1Check Version:
dovecot --versionVerify Fix Applied:
Verify version is 2.3.10.1 or higher with 'dovecot --version' and test email submission functionality📡 Detection & Monitoring
Log Indicators:
- Unexpected service crashes in syslog/messages
- NOOP commands with malformed parameters in Dovecot logs
- Submission/LMTP service restart patterns
Network Indicators:
- Multiple NOOP commands to submission/LMTP ports from single sources
- Traffic patterns indicating service disruption
SIEM Query:
source="dovecot.log" AND ("segmentation fault" OR "NULL pointer" OR "crash" OR "submission-login" OR "lmtp")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2020/May/37
- http://www.openwall.com/lists/oss-security/2020/05/18/1
- https://dovecot.org/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJSZIKSB2NS6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNBXLHPNM4W6/
- https://usn.ubuntu.com/4361-1/
- https://www.debian.org/security/2020/dsa-4690
- https://www.openwall.com/lists/oss-security/2020/05/18/1
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2020/May/37
- http://www.openwall.com/lists/oss-security/2020/05/18/1
- https://dovecot.org/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJSZIKSB2NS6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNBXLHPNM4W6/
- https://usn.ubuntu.com/4361-1/
- https://www.debian.org/security/2020/dsa-4690
- https://www.openwall.com/lists/oss-security/2020/05/18/1
