CVE-2019-11500

Vulnerability

Dovecot versions before 2.2.36.4 and 2.3.x before 2.3.7.2, as well as Pigeonhole before 0.5.7.2, mishandle \0 (null) characters during protocol parsing of quoted strings. This occurs in the IMAP and ManageSieve protocol parsers, where the parsers fail to properly account for null bytes, leading to out-of-bounds writes [4]. The vulnerability affects both pre- and post-authentication code paths [4].

Exploitation

An attacker can send a specially crafted IMAP or ManageSieve command containing a \0 byte within a quoted string. No prior authentication is required for some attack vectors (pre-authentication), while others may require an authenticated session. The attacker does not need any special network position beyond being able to connect to the Dovecot service, as the parsing occurs on the server side [4].

Impact

Successful exploitation allows an attacker to trigger out-of-bounds writes, potentially leading to remote code execution (RCE) with the privileges of the Dovecot process. This can result in full compromise of the email server, including information disclosure, modification, or denial of service [4]. The vulnerability is rated with a CVSS score of Important by Red Hat [3].

Mitigation

The vulnerability is fixed in Dovecot versions 2.2.36.4 and 2.3.7.2, and Pigeonhole version 0.5.7.2 [4]. Red Hat has released updates for Red Hat Enterprise Linux 7 and 8 (e.g., RHSA-2019:2822, RHSA-2019:2885, RHSA-2019:2836) [1][2][3]. Users should update to the patched versions immediately. No workarounds are mentioned in the available references.