Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
The product does not properly control the allocation and maintenance of a limited resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Open-xchange_appsuite | Open-xchange | * | 7.6.3 (excluding) |
| Open-xchange_appsuite | Open-xchange | 7.6.3 (excluding) | 7.10.6 (excluding) |
| Open-xchange_appsuite | Open-xchange | 7.10.6 (excluding) | 8.20 (excluding) |
| Open-xchange_appsuite | Open-xchange | 7.6.3 (including) | 7.6.3 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3464 (including) | 7.6.3-patch_release_3464 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3519 (including) | 7.6.3-patch_release_3519 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3569 (including) | 7.6.3-patch_release_3569 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3627 (including) | 7.6.3-patch_release_3627 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3728 (including) | 7.6.3-patch_release_3728 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3875 (including) | 7.6.3-patch_release_3875 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3922 (including) | 7.6.3-patch_release_3922 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3949 (including) | 7.6.3-patch_release_3949 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_3991 (including) | 7.6.3-patch_release_3991 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4047 (including) | 7.6.3-patch_release_4047 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4133 (including) | 7.6.3-patch_release_4133 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4423 (including) | 7.6.3-patch_release_4423 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4470 (including) | 7.6.3-patch_release_4470 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4552 (including) | 7.6.3-patch_release_4552 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4667 (including) | 7.6.3-patch_release_4667 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4750 (including) | 7.6.3-patch_release_4750 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4789 (including) | 7.6.3-patch_release_4789 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4839 (including) | 7.6.3-patch_release_4839 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4860 (including) | 7.6.3-patch_release_4860 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_4895 (including) | 7.6.3-patch_release_4895 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_5104 (including) | 7.6.3-patch_release_5104 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_5165 (including) | 7.6.3-patch_release_5165 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_5231 (including) | 7.6.3-patch_release_5231 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_5537 (including) | 7.6.3-patch_release_5537 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_5637 (including) | 7.6.3-patch_release_5637 (including) |
| Open-xchange_appsuite | Open-xchange | 7.6.3-patch_release_5910 (including) | 7.6.3-patch_release_5910 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6 (including) | 7.10.6 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6069 (including) | 7.10.6-patch_release_6069 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6073 (including) | 7.10.6-patch_release_6073 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6080 (including) | 7.10.6-patch_release_6080 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6085 (including) | 7.10.6-patch_release_6085 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6093 (including) | 7.10.6-patch_release_6093 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6102 (including) | 7.10.6-patch_release_6102 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6112 (including) | 7.10.6-patch_release_6112 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6121 (including) | 7.10.6-patch_release_6121 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6133 (including) | 7.10.6-patch_release_6133 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6138 (including) | 7.10.6-patch_release_6138 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6141 (including) | 7.10.6-patch_release_6141 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6146 (including) | 7.10.6-patch_release_6146 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6147 (including) | 7.10.6-patch_release_6147 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6148 (including) | 7.10.6-patch_release_6148 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6150 (including) | 7.10.6-patch_release_6150 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6156 (including) | 7.10.6-patch_release_6156 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6161 (including) | 7.10.6-patch_release_6161 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6166 (including) | 7.10.6-patch_release_6166 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6173 (including) | 7.10.6-patch_release_6173 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6176 (including) | 7.10.6-patch_release_6176 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6178 (including) | 7.10.6-patch_release_6178 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6189 (including) | 7.10.6-patch_release_6189 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6194 (including) | 7.10.6-patch_release_6194 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6199 (including) | 7.10.6-patch_release_6199 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6204 (including) | 7.10.6-patch_release_6204 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6205 (including) | 7.10.6-patch_release_6205 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6209 (including) | 7.10.6-patch_release_6209 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6210 (including) | 7.10.6-patch_release_6210 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6214 (including) | 7.10.6-patch_release_6214 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6215 (including) | 7.10.6-patch_release_6215 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6216 (including) | 7.10.6-patch_release_6216 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6218 (including) | 7.10.6-patch_release_6218 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6219 (including) | 7.10.6-patch_release_6219 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6220 (including) | 7.10.6-patch_release_6220 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6227 (including) | 7.10.6-patch_release_6227 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6230 (including) | 7.10.6-patch_release_6230 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6233 (including) | 7.10.6-patch_release_6233 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6235 (including) | 7.10.6-patch_release_6235 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6236 (including) | 7.10.6-patch_release_6236 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6239 (including) | 7.10.6-patch_release_6239 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6241 (including) | 7.10.6-patch_release_6241 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6243 (including) | 7.10.6-patch_release_6243 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6245 (including) | 7.10.6-patch_release_6245 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6248 (including) | 7.10.6-patch_release_6248 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6249 (including) | 7.10.6-patch_release_6249 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6250 (including) | 7.10.6-patch_release_6250 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6251 (including) | 7.10.6-patch_release_6251 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.6-patch_release_6255 (including) | 7.10.6-patch_release_6255 (including) |
Mitigation of resource exhaustion attacks requires that the target system either:
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.