Date: Wed, 28 Aug 2019 15:06:23 +0300 From: Aki Tuomi <aki.tuomi@...ecot.fi> To: oss-security <oss-security@...ts.openwall.com> Subject: Critical Dovecot and Pigeonhole vulnerability Dear subscribers, we have been made aware of critical vulnerability in Dovecot and Pigeonhole. Please find patches attached for dovecot 2.3.7 and pigeonhole 0.5.7 --- Open-Xchange Security Advisory 2019-08-14 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3278 Vulnerability type: Improper input validation (CWE-20) Vulnerable version: All versions prior to 188.8.131.52 and 184.108.40.206 Vulnerable component: IMAP and ManageSieve protocol parsers (before and after login) Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 220.127.116.11, 18.104.22.168 Researcher credits: Nick Roessler and Rafi Rubin, University of Pennsylvania Vendor notification: 2019-04-13 Solution date: 2019-06-05 Public disclosure: 2019-08-28 CVE reference: CVE-2019-11500 CVSS: 8.1 (CVSS3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vulnerability Details: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Risk: This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login phase, allowing sufficiently skilled attacker to perform complicated attacks that can lead to leaking private information or remote code execution. Abuse of this bug is very difficult to observe, as it does not necessarily cause a crash. Attempts to abuse this bug are not directly evident from logs. Steps to reproduce: This bug is best observed using valgrind to see the out of bounds read with following snippet: perl -e 'print "a id (\"foo\" \"".("x"x1021)."\\A\" \"bar\" \"\000".("x"x1020)."\\A\")\n"' | nc localhost 143 Solution: Operators should update to the latest Patch Release. There is no workaround for the issue. --- Aki Tuomi Open-Xchange oy View attachment "0001-lib-imap-Don-t-accept-strings-with-NULs.patch" of type "text/x-patch" (1267 bytes) View attachment "0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch" of type "text/x-patch" (1205 bytes) View attachment "0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch" of type "text/x-patch" (1206 bytes) View attachment "0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch" of type "text/x-patch" (1304 bytes) Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.