Dovecot 2.3.7.2 released, remote exploit

CrazyFrog

Verified User
Joined
Aug 28, 2019
Messages
43
hey all, the message below was just posted to oss-security.

seems that Dovecot has a nasty remote vulnerability. (see below)

The version in custombuild is 2.3.7.1
The fixed version is 2.3.7.2.

could we get a version bump for custombuild?

Dear subscribers, we have been made aware of critical vulnerability in
Dovecot and Pigeonhole.

Please find patches attached for dovecot 2.3.7 and pigeonhole 0.5.7

---

Open-Xchange Security Advisory 2019-08-14

Product: Dovecot
Vendor: OX Software GmbH

Internal reference: DOV-3278
Vulnerability type: Improper input validation (CWE-20)
Vulnerable version: All versions prior to 2.3.7.2 and 2.2.36.4
Vulnerable component: IMAP and ManageSieve protocol parsers (before and
after login)
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.3.7.2, 2.2.36.4
Researcher credits: Nick Roessler and Rafi Rubin, University of Pennsylvania
Vendor notification: 2019-04-13
Solution date: 2019-06-05
Public disclosure: 2019-08-28
CVE reference: CVE-2019-11500
CVSS: 8.1 (CVSS3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Vulnerability Details:

IMAP and ManageSieve protocol parsers do not properly handle NUL byte
when scanning data in quoted strings, leading to out of bounds heap
memory writes.

Risk:

This vulnerability allows for out-of-bounds writes to objects stored on
the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login
phase, allowing sufficiently skilled attacker to perform complicated
attacks that can lead to leaking private information or remote code
execution. Abuse of this bug is very difficult to observe, as it does
not necessarily cause a crash. Attempts to abuse this bug are not
directly evident from logs.

Steps to reproduce:

This bug is best observed using valgrind to see the out of bounds read
with following snippet:

perl -e 'print "a id ("foo" "".("x"x1021)."\\A" "bar"
"\000".("x"x1020)."\\A")\n"' | nc localhost 143


Solution:

Operators should update to the latest Patch Release. There is no
workaround for the issue.

---

Aki Tuomi

Open-Xchange oy
 
Have you

/usr/local/directadmin/custombuild/build update

then

/usr/local/directadmin/custombuild/build versions

My DirectAdmin server is showing Dovecot 2.3.7.2 as being available.

(Although maybe it hasn't circulated to all of the mirrors yet?)
 
oh that's awesome! I just did 30 minutes back and got 2.3.7.1.

I see that 2.3.7.2 is available now :D thanks for letting me know.

updating Dovecot now and I would encourage others to do the same!
 
Back
Top