CVE-2014-0079: Input Validation

Published Jan 30, 2014
·
Updated

I discovered (aside bug #1056767) another flaw in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users.

The issue affects all Zarafa versions from at least Zarafa 6.20.0 (maybe even from at least Zarafa 5.00) up to (including) Zarafa 7.1.8 final. Please note that I was not able to crash the zarafa-server daemon using official upstream Zarafa binary packages just all community builds from the source code such as shipped in Fedora. This different behaviour might be caused that upstream uses different built-time flags or other system libraries and headers.

Once the zarafa-server process crashes with a backtrace (and even all other Zarafa related daemons are still running) there is no Zarafa functionality till zarafa-server daemon is started again. The zarafa-server process provides the MAPI in SOAP service required by all other Zarafa related components as shown: http://doc.zarafa.com/trunk/AdministratorManual/en-US/html/architecture.html

Other sources

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."

MITRE

Affected Software

15 affected components
Zarafa Zarafa<=6.20
Zarafa Zarafa=5.00
Zarafa Zarafa=5.01
Zarafa Zarafa=5.02
Zarafa Zarafa=5.10
Zarafa Zarafa=5.11
Zarafa Zarafa=5.20
Zarafa Zarafa=5.22
Zarafa Zarafa=6.00
Zarafa Zarafa=6.01
Zarafa Zarafa=6.02
Zarafa Zarafa=6.03
Zarafa Zarafa=6.10
Zarafa Zarafa=6.11
Zarafa Zarafa=7.1.8

Event History

Jan 30, 2014
Data Sourced
via Red Hat·09:59 PM
DescriptionSeverityAffected Software
Apr 28, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:09 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2014-0079?

The severity of CVE-2014-0079 is classified as medium.

2

How do I fix CVE-2014-0079?

To fix CVE-2014-0079, you should update Zarafa to a version that is not vulnerable, such as 7.1.8 or higher.

3

Which versions of Zarafa are affected by CVE-2014-0079?

CVE-2014-0079 affects Zarafa versions up to and including 6.20 and specific versions such as 5.00 to 6.11.

4

What type of vulnerability is CVE-2014-0079?

CVE-2014-0079 is an unauthenticated denial of service vulnerability.

5

Can CVE-2014-0079 be exploited remotely?

Yes, CVE-2014-0079 can be exploited remotely, allowing an attacker to cause a denial of service.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203