CVE-2014-0079: Input Validation
I discovered (aside bug #1056767) another flaw in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users.
The issue affects all Zarafa versions from at least Zarafa 6.20.0 (maybe even from at least Zarafa 5.00) up to (including) Zarafa 7.1.8 final. Please note that I was not able to crash the zarafa-server daemon using official upstream Zarafa binary packages just all community builds from the source code such as shipped in Fedora. This different behaviour might be caused that upstream uses different built-time flags or other system libraries and headers.
Once the zarafa-server process crashes with a backtrace (and even all other Zarafa related daemons are still running) there is no Zarafa functionality till zarafa-server daemon is started again. The zarafa-server process provides the MAPI in SOAP service required by all other Zarafa related components as shown: http://doc.zarafa.com/trunk/AdministratorManual/en-US/html/architecture.html
Other sources
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0079?
The severity of CVE-2014-0079 is classified as medium.
How do I fix CVE-2014-0079?
To fix CVE-2014-0079, you should update Zarafa to a version that is not vulnerable, such as 7.1.8 or higher.
Which versions of Zarafa are affected by CVE-2014-0079?
CVE-2014-0079 affects Zarafa versions up to and including 6.20 and specific versions such as 5.00 to 6.11.
What type of vulnerability is CVE-2014-0079?
CVE-2014-0079 is an unauthenticated denial of service vulnerability.
Can CVE-2014-0079 be exploited remotely?
Yes, CVE-2014-0079 can be exploited remotely, allowing an attacker to cause a denial of service.