OX Dovecot Improper Control of Resource Identifiers Vulnerability Allowing Man-in-the-Middle Eavesdropping

A vulnerability exists in OX Dovecot Pro and OX Dovecot CE that allows an attacker to manipulate SCRAM TLS channel binding by using a specially crafted base64 exchange between Dovecot and the client. This exploitation requires the attacker to be positioned between the Dovecot server and the client, effectively acting as a man-in-the-middle. If successful, the attacker can eavesdrop on the communications between Dovecot and the client.

Impact

Exploitation of this vulnerability allows for man-in-the-middle eavesdropping on the communication between Dovecot and the client.

Remediation

Users are advised to upgrade to OX Dovecot Pro 3.1.5 or OX Dovecot CE 2.4.4.