{"id":37658,"date":"2019-10-31T22:18:53","date_gmt":"2019-10-31T19:18:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-imap-servere-dovecot\/"},"modified":"2019-10-31T22:18:53","modified_gmt":"2019-10-31T19:18:53","slug":"kriticheskaya-uyazvimost-v-imap-servere-dovecot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","title":{"rendered":"Kritieke kwetsbaarheid in IMAP-server Dovecot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In correctieve uitgaven<\/a><\/noindex> POP3\/IMAP4-servers Dovecot<\/a><\/noindex> 2.3.7.2 en 2.2.36.4, evenals in de aanvulling Pigeonhole 0.5.7.2 en 0.4.24.2 <\/a><\/noindex>, verholpen kritieke kwetsbaarheid<\/a><\/noindex> (CVE-2019-11500<\/a><\/noindex>), die het mogelijk maakt om gegevens buiten de toegewezen buffer te schrijven door een speciaal gevormd verzoek via de protocollen IMAP of ManageSieve te verzenden. <\/p>\n

Het probleem kan worden misbruikt in de fase v\u00f3\u00f3r authenticatie. Er is tot nu toe geen werkende exploit beschikbaar, maar de ontwikkelaars van Dovecot sluiten de mogelijkheid niet uit dat de kwetsbaarheid kan worden gebruikt om aanvallen voor het op afstand uitvoeren van code in het systeem of om het lekken van vertrouwelijke gegevens te organiseren. Alle gebruikers wordt dringend aangeraden om updates te installeren (Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, SUSE<\/a><\/noindex>, RHEL<\/a><\/noindex>, FreeBSD<\/a><\/noindex>).<\/p>\n

De kwetsbaarheid is aanwezig in de parsers van de protocollen IMAP en ManageSieve en wordt veroorzaakt door een onjuiste verwerking van null-byte-tekens tijdens de parsing van gegevens binnen ingesloten strings. Het probleem kan leiden tot het schrijven van willekeurige gegevens in objecten die buiten de toegewezen buffer worden opgeslagen (voor authenticatie kan tot 8 KB worden overschreven, en na authenticatie tot 64 KB). <\/p>\n

Volgens de mening<\/a><\/noindex> De ingenieurs van Red Hat geven aan dat het probleem voor echte aanvallen wordt bemoeilijkt door het feit dat de aanvaller de positie van willekeurige gegevensoverschrijvingen in de heap niet kan controleren. Als reactie daarop wordt de mening geopperd dat deze eigenschap de aanval aanzienlijk bemoeilijkt, maar deze niet uitsluit - de aanvaller kan zijn pogingen tot exploitatie herhaaldelijk herhalen totdat hij in het actieve gebied in de heap terechtkomt.<\/p>\n

<\/a><\/noindex><\/p>\n

Bron: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 POP3\/IMAP4-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Dovecot 2.3.7.2 \u0438 2.2.36.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 Pigeonhole 0.5.7.2 \u0438 0.4.24.2 , \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11500), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c IMAP \u0438\u043b\u0438 ManageSieve. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0434\u043e \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0420\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d, \u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37658","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kritieke kwetsbaarheid in de IMAP-server Dovecot | ProHoster","description":"In de correctieve uitgaven van de POP3\/IMAP4-servers","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 IMAP-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Dovecot | ProHoster","og:description":"\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 POP3\/IMAP4-\u0441\u0435\u0440\u0432\u0435\u0440\u0430","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:18:53+00:00","article:modified_time":"2019-10-31T19:18:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37658","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 18:45:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:42:52","updated":"2026-01-23 18:45:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/37658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=37658"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/37658\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=37658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=37658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=37658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}