Bug 1130116 (CVE-2019-7524) - VUL-0: CVE-2019-7524: dovecot,dovecot23,dovecot22: FTS or POP3-UIDL header from dovecot index overflow
Summary: VUL-0: CVE-2019-7524: dovecot,dovecot23,dovecot22: FTS or POP3-UIDL header fr...
Status: RESOLVED FIXED
Alias: CVE-2019-7524
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Peter Varkoly
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/226561/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-03-21 16:39 UTC by Marcus Meissner
Modified: 2019-09-04 06:23 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 7 Marcus Meissner 2019-03-28 12:49:38 UTC
is now public

Dear subscribers,

we're sharing our latest advisory with you and would like to thank
everyone who contributed in finding and solving those vulnerabilities.
Feel free to join our bug bounty programs (open-xchange, dovecot,
powerdns) at HackerOne. Please find patches for v2.2.36 and v2.3.5 attached,
or download new version.

Yours sincerely,
Aki Tuomi
Open-Xchange Oy

Product: Dovecot

Vendor: OX Software GmbH
 
Internal reference: DOV-2964 (Bug ID)
Vulnerability type: CWE-120
Vulnerable version: 2.0.14 - 2.3.5
Vulnerable component: fts, pop3-uidl-plugin
Report confidence: Confirmed
Researcher credits: Found in internal testing
Solution status: Fixed by Vendor
Fixed version: 2.3.5.1, 2.2.36.3
Vendor notification: 2019-02-05
Solution date: 2019-03-21
Public disclosure: 2019-03-28
CVE reference: CVE-2019-7524
CVSS: 3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.8)
 
Vulnerability Details:
When reading FTS or POP3-UIDL header from dovecot index, the input
buffer size is not bound, and data is copied to target structure causing
stack overflow.

Risk:
This can be used for local root privilege escalation or executing
arbitrary code in dovecot process context. This requires ability to
directly modify dovecot indexes.
Steps to reproduce:
Produce dovecot.index.log entry that creates an FTS header which has
more than 12 bytes of data.
Trigger dovecot indexer-worker or run doveadm index.
Dovecot will crash.

Mitigations:
Since 2.3.0 dovecot has been compiled with stack smash protection, ASLR,
read-only GOT tables and other techniques that make exploiting this bug
much harder.

Solution:
Operators should update to the latest Patch Release. The only workaround
is to disable FTS and pop3-uidl plugin.

Please find attached patches for 2.2.36 and 2.3.5.
Comment 8 Swamp Workflow Management 2019-04-04 22:20:53 UTC
SUSE-SU-2019:0876-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1130116
CVE References: CVE-2019-7524
Sources used:
SUSE Linux Enterprise Module for Server Applications 15 (src):    dovecot23-2.3.3-4.10.1

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2019-04-08 13:31:21 UTC
SUSE-SU-2019:0900-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1111789,1123022,1130116
CVE References: CVE-2019-3814,CVE-2019-7524
Sources used:
SUSE OpenStack Cloud 7 (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Server 12-SP4 (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Server 12-SP3 (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Server 12-SP2-BCL (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    dovecot22-2.2.31-19.14.2
SUSE Linux Enterprise Server 12-LTSS (src):    dovecot22-2.2.31-19.14.2
SUSE Enterprise Storage 4 (src):    dovecot22-2.2.31-19.14.2

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2019-04-16 13:09:38 UTC
openSUSE-SU-2019:1212-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1130116
CVE References: CVE-2019-7524
Sources used:
openSUSE Leap 15.0 (src):    dovecot23-2.3.3-lp150.8.2
Comment 11 Swamp Workflow Management 2019-04-17 10:24:25 UTC
openSUSE-SU-2019:1220-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1111789,1123022,1130116
CVE References: CVE-2019-3814,CVE-2019-7524
Sources used:
openSUSE Leap 42.3 (src):    dovecot22-2.2.31-2.12.1
Comment 12 Swamp Workflow Management 2019-04-18 12:30:15 UTC
This is an autogenerated message for OBS integration:
This bug (1130116) was mentioned in
https://build.opensuse.org/request/show/695556 Factory / dovecot23
https://build.opensuse.org/request/show/695557 15.1 / dovecot23
Comment 13 Marcus Meissner 2019-09-04 06:23:04 UTC
released