{"id":37658,"date":"2019-10-31T22:18:53","date_gmt":"2019-10-31T19:18:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-imap-servere-dovecot\/"},"modified":"2019-10-31T22:18:53","modified_gmt":"2019-10-31T19:18:53","slug":"kriticheskaya-uyazvimost-v-imap-servere-dovecot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","title":{"rendered":"Kritisk s\u00e5rbarhet i IMAP-serveren Dovecot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I korrektive utgivelser<\/a><\/noindex> POP3\/IMAP4-servere Dovecot<\/a><\/noindex> 2.3.7.2 og 2.2.36.4, samt i tillegg Pigeonhole 0.5.7.2 og 0.4.24.2 <\/a><\/noindex>, er l\u00f8st kritisk s\u00e5rbarhet<\/a><\/noindex> (CVE-2019-11500<\/a><\/noindex>), som gj\u00f8r det mulig \u00e5 oppn\u00e5 skriving av data utenfor den tildelte bufferen ved \u00e5 sende en spesialformatert foresp\u00f8rsel via IMAP- eller ManageSieve-protokollene. <\/p>\n

Problemet kan utnyttes p\u00e5 et stadium f\u00f8r autentisering. Det er forel\u00f8pig ikke utviklet noe fungerende utnyttelse, men utviklerne av Dovecot utelukker ikke muligheten for at s\u00e5rbarheten kan brukes til \u00e5 organisere angrep for fjernutf\u00f8relse av kode i systemet eller til \u00e5 lekke konfidensielle data. Alle brukere anbefales \u00e5 oppdatere umiddelbart (Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, SUSE<\/a><\/noindex>, RHEL<\/a><\/noindex>, FreeBSD<\/a><\/noindex>).<\/p>\n

S\u00e5rbarheten finnes i parserne av IMAP- og ManageSieve-protokollene og er for\u00e5rsaket av feilaktig h\u00e5ndtering av nulltegn under behandling av data i strengene som er innhyllet i anf\u00f8rselstegn. Problemet tillater skriving av vilk\u00e5rlige data i objekter lagret utenfor den tildelte bufferen (i stadiet f\u00f8r autentisering kan man overskrive opptil 8 kB, og etter autentisering opptil 64 kB). <\/p>\n

uttalandet meningen<\/a><\/noindex> Ingenj\u00f6rer fr\u00e5n Red Hat anser att anv\u00e4ndningen av problem f\u00f6r verkliga attacker f\u00f6rsv\u00e5ras av att angriparen inte kan kontrollera positionen f\u00f6r godtycklig data\u00f6verskrivning i minnet. Som svar framh\u00e4vs att denna egenskap endast g\u00f6r attacken avsev\u00e4rt mer komplicerad, men inte utesluter dess genomf\u00f6rande \u2014 angriparen kan repetera utnyttjandet om och om igen tills de tr\u00e4ffar en fungerande del av minnet.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 POP3\/IMAP4-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Dovecot 2.3.7.2 \u0438 2.2.36.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 Pigeonhole 0.5.7.2 \u0438 0.4.24.2 , \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11500), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c IMAP \u0438\u043b\u0438 ManageSieve. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0434\u043e \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0420\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d, \u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37658","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kritisk s\u00e5rbarhet i IMAP-serveren Dovecot | ProHoster","description":"I de korrigerende utgivelsene av POP3\/IMAP4-serveren","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 IMAP-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Dovecot | ProHoster","og:description":"\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 POP3\/IMAP4-\u0441\u0435\u0440\u0432\u0435\u0440\u0430","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/kriticheskaya-uyazvimost-v-imap-servere-dovecot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:18:53+00:00","article:modified_time":"2019-10-31T19:18:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37658","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 18:45:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:42:52","updated":"2026-01-23 18:45:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/37658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=37658"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/37658\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=37658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=37658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=37658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}