Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.
The product does not properly control the allocation and maintenance of a limited resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Open-xchange_appsuite | Open-xchange | * | 7.10.6 (excluding) |
| Open-xchange_appsuite | Open-xchange | 7.10.6 (including) | 7.10.6 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6069 (including) | 7.10.6-patch_release_6069 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6073 (including) | 7.10.6-patch_release_6073 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6080 (including) | 7.10.6-patch_release_6080 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6085 (including) | 7.10.6-patch_release_6085 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6093 (including) | 7.10.6-patch_release_6093 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6102 (including) | 7.10.6-patch_release_6102 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6112 (including) | 7.10.6-patch_release_6112 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6121 (including) | 7.10.6-patch_release_6121 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6133 (including) | 7.10.6-patch_release_6133 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6138 (including) | 7.10.6-patch_release_6138 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6141 (including) | 7.10.6-patch_release_6141 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6146 (including) | 7.10.6-patch_release_6146 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6147 (including) | 7.10.6-patch_release_6147 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6148 (including) | 7.10.6-patch_release_6148 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6150 (including) | 7.10.6-patch_release_6150 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6156 (including) | 7.10.6-patch_release_6156 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6161 (including) | 7.10.6-patch_release_6161 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6166 (including) | 7.10.6-patch_release_6166 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6173 (including) | 7.10.6-patch_release_6173 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6176 (including) | 7.10.6-patch_release_6176 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6178 (including) | 7.10.6-patch_release_6178 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6189 (including) | 7.10.6-patch_release_6189 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6194 (including) | 7.10.6-patch_release_6194 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6199 (including) | 7.10.6-patch_release_6199 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6204 (including) | 7.10.6-patch_release_6204 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6205 (including) | 7.10.6-patch_release_6205 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6209 (including) | 7.10.6-patch_release_6209 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6210 (including) | 7.10.6-patch_release_6210 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6214 (including) | 7.10.6-patch_release_6214 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6215 (including) | 7.10.6-patch_release_6215 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6216 (including) | 7.10.6-patch_release_6216 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6218 (including) | 7.10.6-patch_release_6218 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6219 (including) | 7.10.6-patch_release_6219 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6220 (including) | 7.10.6-patch_release_6220 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6227 (including) | 7.10.6-patch_release_6227 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6230 (including) | 7.10.6-patch_release_6230 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6233 (including) | 7.10.6-patch_release_6233 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6235 (including) | 7.10.6-patch_release_6235 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6236 (including) | 7.10.6-patch_release_6236 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6239 (including) | 7.10.6-patch_release_6239 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6241 (including) | 7.10.6-patch_release_6241 (including) |
Mitigation of resource exhaustion attacks requires that the target system either:
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.