CVE-2020-28944
📋 TL;DR
This vulnerability in OX Guard allows attackers to cause Denial of Service by exploiting a WKS server that responds slowly or with excessive data. It affects OX Guard version 2.10.4 and earlier, potentially disrupting email security services for organizations using this software.
💻 Affected Systems
- OX Guard
📦 What is this software?
Ox Guard by Open Xchange
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of OX Guard email security functionality, preventing email filtering and security scanning operations.
Likely Case
Degraded performance or temporary unavailability of OX Guard services, impacting email security operations.
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place.
🎯 Exploit Status
Exploitation requires ability to control or influence WKS server responses. Public exploit details available in Packet Storm references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OX Guard 2.10.5 or later
Vendor Advisory: https://open-xchange.com
Restart Required: Yes
Instructions:
1. Download latest OX Guard version from vendor portal. 2. Backup current configuration. 3. Stop OX Guard services. 4. Install updated version. 5. Restart services. 6. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict OX Guard access to trusted WKS servers only
iptables -A OUTPUT -p tcp --dport 443 -d trusted_wks_server -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j DROP
Rate Limiting
allImplement rate limiting on WKS server responses
Configure web server rate limiting for WKS endpoints
🧯 If You Can't Patch
- Implement strict network controls to limit OX Guard's access to only essential, trusted WKS servers
- Monitor WKS server response times and implement alerts for abnormal delays or large data transfers
🔍 How to Verify
Check if Vulnerable:
Check OX Guard version via admin interface or configuration files. Versions 2.10.4 and earlier are vulnerable.Check Version:
grep version /opt/open-xchange/etc/guard.propertiesVerify Fix Applied:
Verify OX Guard version is 2.10.5 or later and test WKS functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Unusually long WKS server response times
- Large data transfers from WKS servers
- OX Guard service restarts or crashes
Network Indicators:
- Abnormal traffic patterns to/from WKS servers
- Sustained connections to WKS servers
SIEM Query:
source="ox-guard.log" AND ("WKS timeout" OR "response too large" OR "service unavailable")