[ASA-201903-16] dovecot: privilege escalation

[Remi Gacogne]

Arch Linux Security Advisory ASA-201903-16
==========================================

Severity: High
Date    : 2019-03-28
CVE-ID  : CVE-2019-7524
Package : dovecot
Type    : privilege escalation
Remote  : No
Link    : https://security.archlinux.org/AVG-944

Summary
=======

The package dovecot before version 2.3.5.1-1 is vulnerable to privilege
escalation.

Resolution
==========

Upgrade to 2.3.5.1-1.

# pacman -Syu "dovecot>=2.3.5.1-1"

The problem has been fixed upstream in version 2.3.5.1.

Workaround
==========

None.

Description
===========

A stack-based buffer overflow has been found in Dovecot versions prior
to 2.3.5.1. When reading FTS or POP3-UIDL header from dovecot index,
the input buffer size is not bound, and data is copied to target
structure causing stack overflow. This can be used for local root
privilege escalation or executing arbitrary code in dovecot process
context. This requires ability to directly modify dovecot indexes.

Impact
======

A local attacker with the ability to alter FTS or POP3-UIDL files can
escalate privileges to root.

References
==========

https://seclists.org/oss-sec/2019/q1/197
https://dovecot.org/pipermail/dovecot/2019-March/115296.html
https://github.com/dovecot/core/commit/79679674eb6d2c7d38f2537e613efc103058dff1
https://github.com/dovecot/core/commit/d79845350e0754f5e25c41bd56591ddd5b0a35fd
https://security.archlinux.org/CVE-2019-7524

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20190328/5ca4cef8/attachment.sig>