thr3ads.net - dovecot - CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole [Aug 2019]

If this information is useful, please help other people find it:
Share via:

Aki Tuomi

2019-Aug-28 12:10 UTC

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

Dear subscribers, we have been made aware of critical vulnerability in
Dovecot and Pigeonhole.

---

Open-Xchange Security Advisory 2019-08-14
?
Product: Dovecot
Vendor: OX Software GmbH
?
Internal reference: DOV-3278
Vulnerability type: Improper input validation (CWE-20)
Vulnerable version: All versions prior to 2.3.7.2 and 2.2.36.4
Vulnerable component: IMAP and ManageSieve protocol parsers (before and
after login)
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.3.7.2, 2.2.36.4
Researcher credits: Nick Roessler and Rafi Rubin, University of Pennsylvania
Vendor notification: 2019-04-13
Solution date: 2019-06-05
Public disclosure: 2019-08-28
CVE reference: CVE-2019-11500
CVSS: 8.1 (CVSS3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
?
Vulnerability Details:

IMAP and ManageSieve protocol parsers do not properly handle NUL byte
when scanning data in quoted strings, leading to out of bounds heap
memory writes.

Risk:

This vulnerability allows for out-of-bounds writes to objects stored on
the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login
phase, allowing sufficiently skilled attacker to perform complicated
attacks that can lead to leaking private information or remote code
execution. Abuse of this bug is very difficult to observe, as it does
not necessarily cause a crash. Attempts to abuse this bug are not
directly evident from logs.

Steps to reproduce:

This bug is best observed using valgrind to see the out of bounds read
with following snippet:

perl -e 'print "a id (\"foo\"
\"".("x"x1021)."\\A\" \"bar\"
\"\000".("x"x1020)."\\A\")\n"' | nc
localhost 143


Solution:

Operators should update to the latest Patch Release. There is no
workaround for the issue.

---

Aki Tuomi

Open-Xchange oy




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20190828/18859c07/attachment.sig>

Christoph Pleger

2019-Aug-28 13:58 UTC

head link

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

Hello,

On 2019-08-28 14:10, Aki Tuomi via dovecot wrote:> Dear subscribers, we have been made aware of critical vulnerability in
> Dovecot and Pigeonhole.
Has this already been fixed in 2.2.36.4? Changelog does not mention it.

Regards
   Christoph

Aki Tuomi

2019-Aug-28 14:03 UTC

head link

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

<!doctype html>
<html>
 <head> 
  <meta charset="UTF-8"> 
 </head>
 <body>
  <div>
   <br>
  </div>
  <blockquote type="cite">
   <div>
    On 28/08/2019 16:58 Christoph Pleger via dovecot <
    <a
href="mailto:dovecot@dovecot.org">dovecot@dovecot.org</a>>
wrote:
   </div>
   <div>
    <br>
   </div>
   <div>
    <br>
   </div>
   <div>
    Hello,
   </div>
   <div>
    <br>
   </div>
   <div>
    On 2019-08-28 14:10, Aki Tuomi via dovecot wrote:
   </div>
   <blockquote type="cite">
    <div>
     Dear subscribers, we have been made aware of critical vulnerability in
    </div>
    <div>
     Dovecot and Pigeonhole.
    </div>
   </blockquote>
   <div>
    Has this already been fixed in 2.2.36.4? Changelog does not mention it.
   </div>
   <div>
    <br>
   </div>
   <div>
    Regards
   </div>
   <div>
    Christoph
   </div>
  </blockquote>
  <div>
   https://dovecot.org/pipermail/dovecot-news/2019-August/000416.html
   <br>
  </div>
  <div>
   <br>
  </div>
  <div class="io-ox-signature">
   <pre>---
Aki Tuomi</pre>
  </div> 
 </body>
</html>

Giles Coochey

2019-Aug-28 15:38 UTC

head link

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

On 28/08/2019 14:58, Christoph Pleger via dovecot wrote:> Hello,
>
> On 2019-08-28 14:10, Aki Tuomi via dovecot wrote:
>> Dear subscribers, we have been made aware of critical vulnerability in
>> Dovecot and Pigeonhole.
>
> Has this already been fixed in 2.2.36.4? Changelog does not mention it.
>
Solution status: Fixed by Vendor
Fixed version: 2.3.7.2, 2.2.36.4
> Regards
> ? Christoph
-- 
Giles Coochey

Christian Balzer

2019-Aug-30 08:00 UTC

head link

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

Hello,

Cc'ing Apollon in hopes he might have some insight here.

When upgrading on Debian Stretch with the security fix packages all
dovecot processes get killed and then restarted despite having 
"shutdown_clients = no" set. 

My guess would be a flaw in the upgrade procedure and/or unit files doing
a stop and start when the new imapd package is installed.

Can anybody think of a quick workaround or fix for this, as it's clearly
not intended behavior (nor needed for this issue).


Thanks,

Christian
-- 
Christian Balzer        Network/Systems Engineer                
chibi at gol.com   	Rakuten Mobile Inc.

Daniel Lange

2019-Aug-30 15:38 UTC

head link

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

Am 30.08.19 um 10:00 schrieb Christian Balzer via
dovecot:> When upgrading on Debian Stretch with the security fix packages all
> dovecot processes get killed and then restarted despite having
> "shutdown_clients = no" set.
This is systemd doing its "magic" (kill all control group processes), 
see https://dovecot.org/pipermail/dovecot/2016-June/104546.html
for a potential fix.

KSB

2019-Sep-03 19:32 UTC

head link

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

On 2019.08.28. 15:10, Aki Tuomi via dovecot wrote:> 
> Steps to reproduce:
> 
> This bug is best observed using valgrind to see the out of bounds read
> with following snippet:
> 
> perl -e 'print "a id (\"foo\"
\"".("x"x1021)."\\A\" \"bar\"
> \"\000".("x"x1020)."\\A\")\n"' | nc
localhost 143
> 
> 
Hi!
Before I had 2.2.25 and returned result was:
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE 
IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
a BAD Missing ')'

now I upgraded to 2.2.36.4 and the result is the same.

--
KSB

KSB

2019-Sep-03 22:22 UTC

head link

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

On 2019.09.03. 22:32, KSB via dovecot wrote:> On 2019.08.28. 15:10, Aki Tuomi via dovecot wrote:
>>
>> Steps to reproduce:
>>
>> This bug is best observed using valgrind to see the out of bounds read
>> with following snippet:
>>
>> perl -e 'print "a id (\"foo\"
\"".("x"x1021)."\\A\" \"bar\"
>> \"\000".("x"x1020)."\\A\")\n"' |
nc localhost 143
>>
>>
> 
> Hi!
> Before I had 2.2.25 and returned result was:
> * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE 
> IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
> a BAD Missing ')'
> 
> now I upgraded to 2.2.36.4 and the result is the same.
> 
> -- 
> KSB
Btw, got 1 time:
perl -e 'print "a id (\"foo\"
\"".("x"x1021)."\\A\" \"bar\"
\"\000".("x"x1020)."\\A\")\n"' | nc
localhost 143
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE 
IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
a BAD Missing ')'
* BYE Input buffer full, aborting

with 2.2.36.4

--
KSB

Possibly Parallel Threads

Search for more apparently analagous threads

dovecot - Aug 2019 - CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

Possibly Parallel Threads