Open-Xchange Dovecot ManageSieve AUTHENTICATE Command Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Open-Xchange Dovecot Pro and Community Edition ManageSieve services, specifically in versions 2.4.0, 3.0.2, 3.1.0, and prior to 2.4.3. The issue arises when the AUTHENTICATE command is used with a literal as the SASL initial response, causing the ManageSieve service to crash. This crash can be repeated, making the service unavailable for other users.

Impact

Exploiting this vulnerability causes the ManageSieve service to crash, leading to a denial-of-service condition where the service becomes unavailable for other users.

Remediation

Users can control access to the ManageSieve port or disable the service if it is not needed. Alternatively, they can upgrade to a fixed version.