exploit the possibilities

Debian Security Advisory 4418-1

Debian Security Advisory 4418-1
Posted Mar 29, 2019
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4418-1 - A vulnerability was discovered in the Dovecot email server. When reading FTS or POP3-UIDL headers from the Dovecot index, the input buffer size is not bounds-checked. An attacker with the ability to modify dovecot indexes, can take advantage of this flaw for privilege escalation or the execution of arbitrary code with the permissions of the dovecot user. Only installations using the FTS or pop3 migration plugins are affected.

tags | advisory, arbitrary
systems | linux, debian
advisories | CVE-2019-7524
MD5 | 4e1a2f468792a0aeca021bb8b40fffcb

Debian Security Advisory 4418-1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4418-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 28, 2019 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : dovecot
CVE ID : CVE-2019-7524

A vulnerability was discovered in the Dovecot email server. When reading
FTS or POP3-UIDL headers from the Dovecot index, the input buffer size
is not bounds-checked. An attacker with the ability to modify dovecot
indexes, can take advantage of this flaw for privilege escalation or the
execution of arbitrary code with the permissions of the dovecot user.
Only installations using the FTS or pop3 migration plugins are affected.

For the stable distribution (stretch), this problem has been fixed in
version 1:2.2.27-3+deb9u4.

We recommend that you upgrade your dovecot packages.

For the detailed security status of dovecot please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/dovecot

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlydJ2BfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0QeAxAAnrz+NqPivUYsdYgGYodb62w2/ofsuRu88KPaCUiGU/yGNG7kbrCD86D6
mYzdvrr9k2IO4vpDVj4CxEMUAVVEeoZB2SFw/8EoCjk+OlNT5prWcbIrnV3A9nGW
IqHo39nBnwwSCq6ork4PtOJMWcoiHHvKSRt48qs0X56MJ/I+tUzbOhCTFNEal6/8
TtWnhJs5uJy/VyrjLfCK5NXdU8uxhN5i1kyKyjS60Ddtvsmx/mMM0dMXdCOzE83w
zJ+ipPNlJmDHaWv7ZG3nJXo03Hn8Pm/cbZ2Le1RF3EiJ76jwx62K2JyBFDIkVxJc
a0lwvCxTSlrpSFZj1ljwsotoJ1GCWyh9NbEvEl1teBESH/n+eUhAJ+rRw0yNUcED
h8bT9zN1ijJiIHtkESChGy/7c+cTycrbSwodoa9eAYKi/RxfKJRdrAopMMa48RWT
MoF2YaMvUFpcok7xdukt4PdFUSTkncP6yU/9j3IA9r18wbzWINl/Nmqzu3Vu53fE
jJuUOeqHFXbOvYuwsvi/zE87ZIsnlZ1NLJv2hN7hvlespV+mXSBA30ccCkuFgShc
PD43YjqZBi443LK8XbFCJ6G4f57yKm+IdlhDf1lm2vAwuBiGHcwwrMietLdpCMhN
YPQRQZJz2XoiZnktxOzu7WG9inUNh00xkTygriExrN9m4Z8z3X0=tQEW
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    15 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close