{"id":37658,"date":"2019-10-31T22:18:53","date_gmt":"2019-10-31T19:18:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-imap-servere-dovecot\/"},"modified":"2019-10-31T22:18:53","modified_gmt":"2019-10-31T19:18:53","slug":"kriticheskaya-uyazvimost-v-imap-servere-dovecot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","title":{"rendered":"Kriti\u010dna ranljivost na IMAP stre\u017eniku Dovecot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V popravki<\/a><\/noindex> POP3\/IMAP4 stre\u017eniki Dovecot<\/a><\/noindex> 2.3.7.2 in 2.2.36.4, ter v dodatku Pigeonhole 0.5.7.2 in 0.4.24.2 <\/a><\/noindex>, odpravljena kriti\u010dna ranljivost<\/a><\/noindex> (CVE-2019-11500<\/a><\/noindex>), ki omogo\u010da zapis podatkov izven dodeljenega pomnilnika preko po\u0161iljanja posebej oblikovanega zahtevka po protokolih IMAP ali ManageSieve. <\/p>\n

Te\u017eava se lahko izkori\u0161\u010da v fazi pred autentifikacijo. Delujo\u010d izkori\u0161\u010devalec zaenkrat \u0161e ni pripravljen, vendar razvijalci Dovecot ne izklju\u010dujejo mo\u017enosti izkori\u0161\u010danja ranljivosti za organizacijo napadov na daljavo ali za ugrabitev zaupnih podatkov. Vsem uporabnikom se priporo\u010da takoj\u0161nja namestitev posodobitev (Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, SUSE<\/a><\/noindex>, RHEL<\/a><\/noindex>, FreeBSD<\/a><\/noindex>).<\/p>\n

Ranljivost je prisotna v parserjih protokolov IMAP in ManageSieve in jo povzro\u010da nepravilno obravnavanje znakov z ni\u010delnim kodom med obdelavo podatkov znotraj nizov, ki so navedeni v narekovajih. Te\u017eava omogo\u010da zapis proizvoljnih podatkov v objekte, shranjene izven dodeljenega pomnilnika (v fazi pred autentifikacijo je mogo\u010de prepisati do 8 kB, po autentifikaciji pa do 64 kB). <\/p>\n

Po mi\u0161ljenju<\/a><\/noindex> In\u017eenirjem podjetja Red Hat je uporaba te\u017eav za dejanske napade ote\u017eena, saj napadalec ne more nadzorovati polo\u017eaja poljubne prepisane podatke v kupu. V odgovor se izra\u017ea mnenje, da ta posebnost le bistveno ote\u017ei napad, ne izklju\u010duje pa njegove izvedbe - napadalec lahko znova in znova posku\u0161a izkoristiti, dokler ne pride v delovno obmo\u010dje v kupu.<\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 POP3\/IMAP4-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Dovecot 2.3.7.2 \u0438 2.2.36.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 Pigeonhole 0.5.7.2 \u0438 0.4.24.2 , \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11500), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c IMAP \u0438\u043b\u0438 ManageSieve. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0434\u043e \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0420\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d, \u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37658","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriti\u010dna ranljivost na IMAP stre\u017eniku Dovecot | ProHoster","description":"V popravkih POP3\/IMAP4 stre\u017enika","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 IMAP-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Dovecot | ProHoster","og:description":"\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 POP3\/IMAP4-\u0441\u0435\u0440\u0432\u0435\u0440\u0430","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:18:53+00:00","article:modified_time":"2019-10-31T19:18:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37658","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 18:45:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:42:52","updated":"2026-01-23 18:45:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/37658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=37658"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/37658\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=37658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=37658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=37658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}