Aki Tuomi
2019-Mar-28 11:42 UTC
[Dovecot-news] CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-2964 (Bug ID) Vulnerability type: CWE-120 Vulnerable version: 2.0.14 - 2.3.5 Vulnerable component: fts, pop3-uidl-plugin Report confidence: Confirmed Researcher credits: Found in internal testing Solution status: Fixed by Vendor Fixed version: 2.3.5.1, 2.2.36.3 Vendor notification: 2019-02-05 Solution date: 2019-03-21 Public disclosure: 2019-03-28 CVE reference: CVE-2019-7524 CVSS: 3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.8) ? Vulnerability Details: When reading FTS or POP3-UIDL header from dovecot index, the input buffer size is not bound, and data is copied to target structure causing stack overflow. Risk: This can be used for local root privilege escalation or executing arbitrary code in dovecot process context. This requires ability to directly modify dovecot indexes. Steps to reproduce: Produce dovecot.index.log entry that creates an FTS header which has more than 12 bytes of data. Trigger dovecot indexer-worker or run doveadm index. Dovecot will crash. Mitigations: Since 2.3.0 dovecot has been compiled with stack smash protection, ASLR, read-only GOT tables and other techniques that make exploiting this bug much harder. Solution: Operators should update to the latest Patch Release. The only workaround is to disable FTS and pop3-uidl plugin. -- Aki Tuomi Open-Xchange Oy -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 488 bytes Desc: OpenPGP digital signature URL: <https://dovecot.org/pipermail/dovecot-news/attachments/20190328/a0017ea6/attachment.sig>
Kevin A. McGrail
2019-Mar-28 14:37 UTC
Mitigation / disable FTS and pop3-uidl plugin was Re: CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
On 3/28/2019 7:42 AM, Aki Tuomi via dovecot wrote:> olution: > Operators should update to the latest Patch Release. The only workaround > is to disable FTS and pop3-uidl plugin.Hi Aki, thanks for the CVE.? For quick mitigation, can you confirm how to disable these plugins and what they provide?? We'd like to assess if we are using them while we rollout the fix. Regards, KAM
Aki Tuomi
2019-Mar-28 14:40 UTC
Mitigation / disable FTS and pop3-uidl plugin was Re: CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
<br>
</div>
<blockquote type="cite">
<div>
On 28 March 2019 16:37 Kevin A. McGrail via dovecot <
<a
href="mailto:dovecot@dovecot.org">dovecot@dovecot.org</a>>
wrote:
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div>
On 3/28/2019 7:42 AM, Aki Tuomi via dovecot wrote:
</div>
<blockquote type="cite">
<div>
olution:
</div>
<div>
Operators should update to the latest Patch Release. The only workaround
</div>
<div>
is to disable FTS and pop3-uidl plugin.
</div>
</blockquote>
<div>
Hi Aki, thanks for the CVE. For quick mitigation, can you confirm how
</div>
<div>
to disable these plugins and what they provide? We'd like to assess if
</div>
<div>
we are using them while we rollout the fix.
</div>
<div>
<br>
</div>
<div>
Regards,
</div>
<div>
<br>
</div>
<div>
KAM
</div>
</blockquote>
<div>
<br>
</div>
<div>
check for fts in mail_plugins. pop3-uidl is used by pop3_migration plugin.
</div>
<div class="io-ox-signature">
<pre>---
Aki Tuomi</pre>
</div>
</body>
</html>
Possibly Parallel Threads
- CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
- Mitigation / disable FTS and pop3-uidl plugin was Re: CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
- Mitigation / disable FTS and pop3-uidl plugin was Re: CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
- CVE-2019-7524 backport patch for 2.2.33.2
- Mitigation / disable FTS and pop3-uidl plugin was Re: CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files