Incoming details.
Open-Xchange Security Advisory 2019-08-14 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3278 Vulnerability type: Improper input validation (CWE-20) Vulnerable version: All versions prior to 2.3.7.2 and 2.2.36.4 Vulnerable component: IMAP and ManageSieve protocol parsers (before and after login) Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.7.2, 2.2.36.4 Researcher credits: Nick Roessler and Rafi Rubin, University of Pennsylvania Vendor notification: 2019-04-13 Solution date: 2019-06-05 Public disclosure: 2019-08-28 CVE reference: CVE-2019-11500 CVSS: 8.1 (CVSS3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vulnerability Details: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Risk: This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login phase, allowing sufficiently skilled attacker to perform complicated attacks that can lead to leaking private information or remote code execution. Abuse of this bug is very difficult to observe, as it does not necessarily cause a crash. Attempts to abuse this bug are not directly evident from logs. Steps to reproduce: This bug is best observed using valgrind to see the out of bounds read with following snippet: perl -e 'print "a id (\"foo\" \"".("x"x1021)."\\A\" \"bar\" \"\000".("x"x1020)."\\A\")\n"' | nc localhost 143 Solution: Operators should update to the latest Patch Release. There is no workaround for the issue.
*** Bug 693020 has been marked as a duplicate of this bug. ***
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2be94433e1423e60edca085c9a5cb250106125f7 commit 2be94433e1423e60edca085c9a5cb250106125f7 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2019-08-28 20:09:39 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2019-08-28 20:12:09 +0000 net-mail/dovecot: bump to v2.3.7.2 Bug: https://bugs.gentoo.org/692572 Package-Manager: Portage-2.3.72, Repoman-2.3.17 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> net-mail/dovecot/Manifest | 2 + net-mail/dovecot/dovecot-2.3.7.2.ebuild | 291 ++++++++++++++++++++++++++++++++ 2 files changed, 293 insertions(+)
@ maintainer(s): Can we already stabilize =net-mail/dovecot-2.3.7.2?
@ Arches, please test and mark stable: =net-mail/dovecot-2.3.7.2
An automated check of this bug failed - repoman reported dependency errors (33 lines truncated): > dependency.bad net-mail/dovecot/dovecot-2.3.7.2.ebuild: DEPEND: arm64(default/linux/arm64/17.0) ['net-mail/vpopmail'] > dependency.bad net-mail/dovecot/dovecot-2.3.7.2.ebuild: RDEPEND: arm64(default/linux/arm64/17.0) ['net-mail/vpopmail'] > dependency.bad net-mail/dovecot/dovecot-2.3.7.2.ebuild: DEPEND: arm64(default/linux/arm64/17.0) ['net-mail/vpopmail']
x86 stable
amd64 stable
New GLSA request filed.
ppc/ppc64 stable
This issue was resolved and addressed in GLSA 201908-29 at https://security.gentoo.org/glsa/201908-29 by GLSA coordinator Thomas Deutschmann (whissi).
Re-opening for remaining architectures.
hppa stable
arm stable
alpha stable
s390 stable
ia64 stable. Maintainer(s), please cleanup.
cleanup done
Repository is clean, all done.
