CVE-2014-0037: Input Validation
Robert Scheck discovered a flaw in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users.
Acknowledgements:
Red Hat would like to thank Robert Scheck of ETES GmbH for reporting this issue.
Other sources
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0037?
CVE-2014-0037 has been classified as a medium severity vulnerability that allows a remote attacker to crash the zarafa-server daemon.
How do I fix CVE-2014-0037?
To fix CVE-2014-0037, it is recommended to update to a patched version of Zarafa that addresses this vulnerability.
What versions of Zarafa are affected by CVE-2014-0037?
CVE-2014-0037 affects multiple versions of Zarafa including 5.00, 5.01, 5.02, through 7.1.4.
Can CVE-2014-0037 be exploited remotely?
Yes, CVE-2014-0037 can be exploited by a remote unauthenticated attacker.
What impact does CVE-2014-0037 have on Zarafa users?
CVE-2014-0037 can result in a denial of service, preventing legitimate users from accessing the zarafa-server.