Out-of-bounds write in Dovecot - CVE-2019-11500

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU20432

Out-of-bounds write in Dovecot - CVE-2019-11500

Published: August 28, 2019


Vulnerability identifier: #VU20432
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-11500
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within IMAP and ManageSieve protocol implementation the when scanning data in quoted strings. A remote attacker can send a specially crafted request to the affected server, trigger out-of-bounds write and execute arbitrary code on the target system.

Exploitation example: 

perl -e 'print "a id (\"foo\" \"".("x"x1021)."\\A\" \"bar\"
\"\000".("x"x1020)."\\A\")\n"' | nc localhost 143

Affected software

Dovecot
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
dovecot (Alpine package)
dovecot (Ubuntu package)
dovecot (Debian package)
dovecot

How to mitigate CVE-2019-11500

Install updates from vendor's website.

Dovecot - addressed in versions 2.2.36.4, 2.3.7.2
dovecot (Alpine package) - update to 2.2.36.4-r0
dovecot (Ubuntu package) - addressed in versions 1:2.2.22-1ubuntu2.11, 1:2.2.22-1ubuntu2.12, 1:2.2.33.2-1ubuntu4.4, 1:2.2.33.2-1ubuntu4.5, 1:2.3.4.1-1ubuntu2.3, 1:2.3.4.1-1ubuntu2.4
dovecot (Debian package) - update to 1:2.2.27-3+deb9u5
dovecot - addressed in versions 2.3.7.2-1.fc29, 2.3.7.2-1.fc30, 2.3.7.2-1.fc31, 2.3.7.2-1.fc32

External References

Related Security Bulletins