Bug 730748 – <gnome-extra/evolution-data-server-3.36.4: Response injection via STARTTLS (SMTP, POP3) (CVE-2020-14928)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2020-07-04 18:21:19 UTC]

From URL:
"We found a STARTTLS issue in Evolution, which affects SMTP and POP3.
When the server responds with its "let's do TLS now message", e.g. +OK begin TLS\r\n, Evolution will read any data after the \r\n and save it into some internal buffer for later processing. 

This is problematic, because a MITM attacker can inject arbitrary responses. I havn't tested it to this extent, but I suspect that this is enough to forge an entire new POP3 mailbox.
There is a nice blogpost by Wietse Venema about a "command injection" in postfix (http://www.postfix.org/CVE-2011-0411.html). 

What we have here is the problem in reverse, i.e. not a command injection, but a "response injection."

Example trace to give an intuition:

C: stls
S: +OK begin TLS
   +OK ack future user command // injected response
   +OK ack future pass command // injected response
<--- TLS --->
C: user alice
// here, Evolution interprets the first injected "+OK" response and proceeds...
C: pass password
// here, Evolution interprets the second injected "+OK" response and proceeds... 
...
An attacker can inject many more responses and (in the worst case) mimic a whole session."

[Comment 1 Sam James 2020-07-04 18:23:00 UTC]

Fixed in 3.36.4, 3.37.3

https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/e3ce982c52aac2b094c6bc7fca7b746213714222

https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/ebb4a3d7576118b282b1e951a696bd7062b73749

Thanks to leio for pinging about this.

[Comment 2 Larry the Git Cow 2020-07-04 21:18:46 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=80ea3296f50742cd45e11c9e873fb9998f6be688

commit 80ea3296f50742cd45e11c9e873fb9998f6be688
Author:     Mart Raudsepp <[e-mail]>
AuthorDate: 2020-07-04 17:52:39 +0000
Commit:     Mart Raudsepp <[e-mail]>
CommitDate: 2020-07-04 21:18:17 +0000

    gnome-extra/evolution-data-server: bump to 3.36.4, fixes CVE-2020-14928
    
    Bug: https://bugs.gentoo.org/730748
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <[e-mail]>

 gnome-extra/evolution-data-server/Manifest         |   1 +
 .../evolution-data-server-3.36.4.ebuild            | 148 +++++++++++++++++++++
 2 files changed, 149 insertions(+)

[Comment 3 Agostino Sarubbo 2020-07-09 09:04:47 UTC]

x86 stable

[Comment 4 Sam James 2020-07-17 00:05:15 UTC]

amd64: ping

[Comment 5 Agostino Sarubbo 2020-07-17 07:22:59 UTC]

amd64 stable.

Maintainer(s), please cleanup.
Security, please vote.