CVE-2019-11494

Vulnerability

The submission-login service in Dovecot versions 2.3.3 through 2.3.5.2 contains a crash vulnerability. The issue occurs in the IMAP Server when a client disconnects prematurely while the AUTH command is being processed. This can lead to a denial-of-service condition for the submission-login service. [1][2]

Exploitation

An attacker can exploit this vulnerability by initiating an IMAP connection to a vulnerable Dovecot server, sending the AUTH command, and then abruptly disconnecting. No prior authentication or special privileges are required; the attacker only needs network access to the IMAP port. The premature disconnection triggers a crash in the submission-login process. [3]

Impact

Successful exploitation results in a crash of the submission-login service, causing a denial of service. This prevents legitimate users from accessing the submission-login functionality until the service is restarted. The confidentiality and integrity of data are not directly impacted. [3]

Mitigation

Dovecot has not publicly disclosed a fixed version in the available references. Administrators should monitor the Dovecot security page for updates. As a workaround, limiting access to the IMAP service to trusted networks may reduce exposure. The issue is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.