Open-Xchange Dovecot Timing Oracle Vulnerability in Doveadm Credential Verification

A vulnerability exists in Open-Xchange Dovecot Pro and Community Edition, specifically in versions 2.3.0, 2.3.22.1, 3.0.2, 3.0.5, 3.1.0, and 2.4.0. The issue arises because doveadm credentials are verified through direct comparison, creating a timing oracle vulnerability. This flaw allows an attacker to deduce the configured credentials, potentially leading to full access to the affected component. The vulnerability can be exploited by sending crafted authentication data that takes advantage of the timing discrepancy in the credential verification process.

Impact

Exploitation of this vulnerability allows for unauthorized access to the doveadm component, bypassing normal authentication mechanisms.

Remediation

Users are advised to limit access to the doveadm HTTP service port and to upgrade to a fixed version. The specific versions to upgrade to are Open-Xchange Dovecot Pro 3.1.4 or Open-Xchange Dovecot Community Edition 2.4.3.