The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4110-3 advisory.

    USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check.
    This update fixes the problem.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for dovecot23 fixes the following issues :

CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559)

CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625).

CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2822 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds     writes (CVE-2019-11500)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0115 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-11500:
    In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing     can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-     bounds writes and remote code execution.

    CVE-2019-3814:
    It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users.

    CVE-2020-10957:
    In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a     NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

    CVE-2020-10958:
    In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in     submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines     after a command.

    CVE-2020-10967:
    In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by     sending mail with an empty localpart.

    CVE-2020-12100:
    In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to     cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME     parts.

    CVE-2020-12673:
    In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because     of an out-of-bounds read.

    CVE-2020-12674:
    In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because     a length of zero is mishandled.

    CVE-2020-24386:
    An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can     trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages     (and path disclosure).

    CVE-2020-25275:
    Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application     crash via a crafted email message with certain choices for ten thousand MIME parts.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Aki Tuomi reports :

Vulnerability Details :

IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes.

Risk :

This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login phase, allowing sufficiently skilled attacker to perform complicated attacks that can lead to leaking private information or remote code execution. Abuse of this bug is very difficult to observe, as it does not necessarily cause a crash. Attempts to abuse this bug are not directly evident from logs.

According to the version of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2     (and Pigeonhole before 0.5.7.2), protocol processing     can fail for quoted strings. This occurs because '\0'     characters are mishandled, and can lead to     out-of-bounds writes and remote code     execution.(CVE-2019-11500)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2     (and Pigeonhole before 0.5.7.2), protocol processing     can fail for quoted strings. This occurs because '\0'     characters are mishandled, and can lead to     out-of-bounds writes and remote code     execution.(CVE-2019-11500)

  - A specially crafted email delivered over SMTP and     passed on to Dovecot by MTA can trigger an out of     bounds read resulting in potential sensitive     information disclosure and denial of service. In order     to trigger this vulnerability, an attacker needs to     send a specially crafted email message to the     server.(CVE-2017-14461)

  - A denial of service flaw was found in dovecot before     2.2.34. An attacker able to generate random SNI server     names could exploit TLS SNI configuration lookups,     leading to excessive memory usage and the process to     restart.(CVE-2017-15130)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.(CVE-2019-11500)

Nick Roessler and Rafi Rubin discovered that the IMAP and ManageSieve protocol parsers in the Dovecot email server do not properly validate input (both pre- and post-login). A remote attacker can take advantage of this flaw to trigger out of bounds heap memory writes, leading to information leaks or potentially the execution of arbitrary code.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has dovecot packages installed that are affected by a vulnerability:

  - In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and     Pigeonhole before 0.5.7.2), protocol processing can fail     for quoted strings. This occurs because '\0' characters     are mishandled, and can lead to out-of-bounds writes and     remote code execution. (CVE-2019-11500)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
128321	Ubuntu 16.04 LTS / 18.04 LTS : Dovecot regression (USN-4110-3)	Nessus	Ubuntu Local Security Checks	2019/8/29	2024/10/29	critical
129554	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2019:2514-1)	Nessus	SuSE Local Security Checks	2019/10/3	2024/4/19	critical
129090	RHEL 8 : dovecot (RHSA-2019:2822)	Nessus	Red Hat Local Security Checks	2019/9/20	2024/11/7	critical
236418	Alibaba Cloud Linux 3 : 0115: dovecot (ALINUX3-SA-2022:0115)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
128310	FreeBSD : Dovecot -- improper input validation (abaaecda-ea16-43e2-bad0-d34a9ac576b1)	Nessus	FreeBSD Local Security Checks	2019/8/29	2024/4/30	critical
129430	EulerOS 2.0 SP8 : dovecot (EulerOS-SA-2019-2071)	Nessus	Huawei Local Security Checks	2019/9/30	2024/4/22	critical
130847	EulerOS 2.0 SP5 : dovecot (EulerOS-SA-2019-2138)	Nessus	Huawei Local Security Checks	2019/11/12	2024/4/12	critical
130600	Amazon Linux 2 : dovecot (ALAS-2019-1347)	Nessus	Amazon Linux Local Security Checks	2019/11/7	2024/4/15	critical
128307	Debian DSA-4510-1 : dovecot - security update	Nessus	Debian Local Security Checks	2019/8/29	2024/4/30	critical
132485	NewStart CGSL CORE 5.05 / MAIN 5.05 : dovecot Vulnerability (NS-SA-2019-0244)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2024/4/2	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical