{"id":37658,"date":"2019-10-31T22:18:53","date_gmt":"2019-10-31T19:18:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-imap-servere-dovecot\/"},"modified":"2019-10-31T22:18:53","modified_gmt":"2019-10-31T19:18:53","slug":"kriticheskaya-uyazvimost-v-imap-servere-dovecot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","title":{"rendered":"Kriitiline haavatavus Dovecoti IMAP-serveris","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V korrektsed v\u00e4ljalasked<\/a><\/noindex> POP3\/IMAP4-serverid Dovecot<\/a><\/noindex> 2.3.7.2 ja 2.2.36.4, samuti lisana Pigeonhole 0.5.7.2 ja 0.4.24.2 <\/a><\/noindex>, k\u00f5rvaldatud kriitiline haavatavus<\/a><\/noindex> (CVE-2019-11500<\/a><\/noindex>), mis v\u00f5imaldab andmete salvestamist eraldatud puhvrisse suunatud erikujundatud p\u00e4ringu saatmise kaudu IMAP v\u00f5i ManageSieve protokollide kaudu. <\/p>\n

Probleemi saab \u00e4ra kasutada autentimisetapi ajal. T\u00f6\u00f6v\u00f5imekust seni ei ole v\u00e4lja t\u00f6\u00f6tatud, kuid Dovecoti arendajad ei v\u00e4lista v\u00f5imalust, et haavatavust saab kasutada s\u00fcsteemi kaugkohtut\u00e4itmise r\u00fcnnakute korraldamiseks v\u00f5i konfidentsiaalsete andmete lekkimiseks. K\u00f5ikidele kasutajatele soovitatakse kiiresti rakendada v\u00e4rskendusi (Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linuxis<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, SUSE<\/a><\/noindex>, RHEL<\/a><\/noindex>, FreeBSD<\/a><\/noindex>).<\/p>\n

Haavatavus esineb IMAP ja ManageSieve protokollide parsijates ja on p\u00f5hjustatud nullkoodiga s\u00fcmbolite vale k\u00e4sitlemisest andmete anal\u00fc\u00fcsi k\u00e4igus tsitaatides. Probleem v\u00f5imaldab salvestada suvalisi andmeid objekteesse, mis asuvad eraldatud puhvrise (autentimise eel on v\u00f5imalik kirjutada kuni 8 KB, autentimise j\u00e4rel kuni 64 KB). <\/p>\n

Kohal arvamusele<\/a><\/noindex> Red Hat'i insenerite arvates on probleemi kasutamine reaalses r\u00fcnnakus keeruline, kuna r\u00fcndajal puudub kontroll suvalise andmete \u00fcle kirjutamise positsiooni \u00fcle heap'is. Vastuseks v\u00e4ljendatakse arvamust, et see omadus keerustab r\u00fcnnakut, kuid ei v\u00e4lista selle l\u00e4biviimist \u2014 r\u00fcndaja v\u00f5ib pidevalt proovida ekspluateerimist, kuni satub heap'i t\u00f6\u00f6keskkonda.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 POP3\/IMAP4-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Dovecot 2.3.7.2 \u0438 2.2.36.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 Pigeonhole 0.5.7.2 \u0438 0.4.24.2 , \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11500), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c IMAP \u0438\u043b\u0438 ManageSieve. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0434\u043e \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0420\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d, \u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37658","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriitiline haavatavus Dovecoti IMAP-serveris | ProHoster","description":"POP3\/IMAP4-serveri korrigeerimisv\u00e4ljaannetes","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 IMAP-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Dovecot | ProHoster","og:description":"\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 POP3\/IMAP4-\u0441\u0435\u0440\u0432\u0435\u0440\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:18:53+00:00","article:modified_time":"2019-10-31T19:18:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37658","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 18:45:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:42:52","updated":"2026-01-23 18:45:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37658"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37658\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}