Page tree
Skip to end of metadata
Go to start of metadata

IN PROGRESS  

Background Information

We were made aware of a CVE in Dovecot Versions 2.0.14 - 2.3.5 that involves using Solr on Thursday, March 28th 2019.


Releases

TIERVERSION
7070.0.68
76EOL
7878.0.20
CURRENT78.0.20
RELEASE78.0.20
STABLE78.0.20


Impact

According to the vendor, the risk involves a local root privilege escalation or executing arbitrary code in Dovecot process context. 

The following lines in dovecot.conf are affected: 

dovecot.conf: mail_plugins = quota quota_clone zlib fts fts_solr
dovecot.conf: mail_plugins = $mail_plugins zlib imap_zlib quota_clone virtual  fts fts_solr


How to determine if your server is up to date (pending RPM updates)

The updated RPMs provided by cPanel will contain a changelog entry with the CVE number. You can check for this changelog entry with the following command:

rpm -q --changelog dovecot | grep CVE-2019-7524

This should give you output resembling the following:

- Patch for CVE-2019-7524


Mitigation

Dovecot Solr is an opt-in option that can be installed from the Mange Plugins interface of WHM.

If you have previously installed this plugin, we recommend uninstalling it from your cPanel & WHM until we have released patched versions. 

In WHM, navigate to the WHM Plugins section and uninstall Solr

Home » cPanel » Manage Plugins


Official Upstream Security Report

https://www.dovecot.org/pipermail/dovecot-news/2019-March/000403.html

Product: Dovecot
Vendor: OX Software GmbH
Internal reference: DOV-2964 (Bug ID)
Vulnerability type: CWE-120
Vulnerable version: 2.0.14 - 2.3.5
Vulnerable component: fts, pop3-uidl-plugin
Report confidence: Confirmed
Researcher credits: Found in internal testing
Solution status: Fixed by Vendor
Fixed version: 2.3.5.1, 2.2.36.3
Vendor notification: 2019-02-05
Solution date: 2019-03-21
Public disclosure: 2019-03-28
CVE reference: CVE-2019-7524
CVSS: 3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.8)
 
Vulnerability Details:
When reading FTS or POP3-UIDL header from dovecot index, the input
buffer size is not bound, and data is copied to target structure causing
stack overflow.

Risk:
This can be used for local root privilege escalation or executing
arbitrary code in dovecot process context. This requires ability to
directly modify dovecot indexes.
Steps to reproduce:
Produce dovecot.index.log entry that creates an FTS header which has
more than 12 bytes of data.
Trigger dovecot indexer-worker or run doveadm index.
Dovecot will crash.

Mitigations:
Since 2.3.0 dovecot has been compiled with stack smash protection, ASLR,
read-only GOT tables and other techniques that make exploiting this bug
much harder.

Solution:
Operators should update to the latest Patch Release. The only workaround
is to disable FTS and pop3-uidl plugin.


  • No labels