SB2019060327 - Fedora 29 update for dovecot

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Authentication bypass (CVE-ID: CVE-2019-3814)

The vulnerability allows a remote authenticated attacker to bypass authentication.

The weakness exists due to taking of the username from the user provided authentication fields (e.g. LOGIN command). A remote attacker with access to a valid trusted certificate without the ssl_cert_username_field in it can bypass password verification if the provided trusted SSL certificate is missing the username field and login as anyone else in the system

2) Stack-based buffer overflow (CVE-ID: CVE-2019-7524)

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when reading FTS or POP3-UIDL header from dovecot index. A local user can modify Dovecot index, trigger stack-based buffer overflow and execute arbitrary code on the target system with privileges of the Dovecot process.

3) Input validation error (CVE-ID: CVE-2019-10691)

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to improper input validation of user-supplied characters in UTF-8 encoding within the JSON encoder. A remote unauthenticated attacker can supply a specially crafted string that contains invalid UTF-8 characters via a username during authentication process or via “From” or “Subject” headers in an email (if OX push notification driver is enabled) and crash the affected server.

Successful exploitation of the vulnerability will result in denial of service (DoS) attack.

4) Resource management error (CVE-ID: CVE-2019-11499)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect resource management error within the submission-login when processing incorrect authentication messages over TLS secure channel. A remote attacker can send an invalid authentication message and crash the service.

5) NULL pointer dereference (CVE-ID: CVE-2019-11494)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within Submission-login when processing authentication. A remote attacker can unexpectedly abort the authentication process by disconnecting from the server during authentication and cause the software to crash.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2019-1b61a528dd