CVE-2017-14461
Last modified
CVE-2017-14461 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.. EPSS estimates a 17.57% chance of exploitation in the next 30 days.
Description
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
Metrics
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dovecot | Dovecot | 2.2.33.2 |
| Debian | Debian Linux | 8.0 |
| Debian | Debian Linux | 9.0 |
| Ubuntu | Ubuntu | 14.04 |
| Ubuntu | Ubuntu | 16.04 |
| Ubuntu | Ubuntu | 17.10 |
References
- http://www.securityfocus.com/bid/103201Third Party Advisory, VDB Entry
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510Third Party Advisory
- https://usn.ubuntu.com/3587-1/Patch, Third Party Advisory
- https://www.debian.org/security/2018/dsa-4130Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlIssue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/103201Third Party Advisory, VDB Entry
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510Third Party Advisory
- https://usn.ubuntu.com/3587-1/Patch, Third Party Advisory
- https://www.debian.org/security/2018/dsa-4130Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlIssue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14461?
How severe is CVE-2017-14461?
How do I fix CVE-2017-14461?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14456Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-14457An exploitable information leak/denial of service vulnerabil…8.2
- CVE-2017-14458An exploitable use-after-free vulnerability exists in the Ja…8.8
- CVE-2017-14459An exploitable OS Command Injection vulnerability exists in …10
- CVE-2017-1446IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulner…5.4
- CVE-2017-14460An exploitable overly permissive cross-domain (CORS) whiteli…7.5
- CVE-2017-14462An exploitable access control vulnerability exists in the da…9.8
- CVE-2017-14463An exploitable access control vulnerability exists in the da…9.8
- CVE-2017-14464An exploitable access control vulnerability exists in the da…9.8
- CVE-2017-14465An exploitable access control vulnerability exists in the da…9.8
- CVE-2017-14466An exploitable access control vulnerability exists in the da…9.8
- CVE-2017-14467An exploitable access control vulnerability exists in the da…9.8
Are you affected by CVE-2017-14461?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST