Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

In proxy mode dovecot did not verify that the SSL certificate of the remote actually matched the server name.

Dovecot was updated to version 2.0.16 which fixes the problem.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0520 advisory.

    [1:2.0.9-5]
    - script-login did not drop privileges correctly (#709095)
    - fix directory traversal due to not obeying chroot directive (#709097)
    - check proxy destination host against SSL certificate name (#754980)

    [1:2.0.9-4]
    - dovecot may not set correct premissions for mail folder (#697620)

    [1:2.0.9-3]
    - fix potential crash when parsing header names that contain NUL characters (#728673)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated dovecot packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Dovecot is an IMAP server, written with security primarily in mind, for Linux and other UNIX-like systems. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are provided as sub-packages.

Two flaws were found in the way some settings were enforced by the script-login functionality of Dovecot. A remote, authenticated user could use these flaws to bypass intended access restrictions or conduct a directory traversal attack by leveraging login scripts.
(CVE-2011-2166, CVE-2011-2167)

A flaw was found in the way Dovecot performed remote server identity verification, when it was configured to proxy IMAP and POP3 connections to remote hosts using TLS/SSL protocols. A remote attacker could use this flaw to conduct man-in-the-middle attacks using an X.509 certificate issued by a trusted Certificate Authority (for a different name). (CVE-2011-4318)

This update also fixes the following bug :

* When a new user first accessed their IMAP inbox, Dovecot was, under some circumstances, unable to change the group ownership of the inbox directory in the user's Maildir location to match that of the user's mail spool (/var/mail/$USER). This correctly generated an 'Internal error occurred' message. However, with a subsequent attempt to access the inbox, Dovecot saw that the directory already existed and proceeded with its operation, leaving the directory with incorrectly set permissions. This update corrects the underlying permissions setting error. When a new user now accesses their inbox for the first time, and it is not possible to set group ownership, Dovecot removes the created directory and generates an error message instead of keeping the directory with incorrect group ownership. (BZ#697620)

Users of dovecot are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the dovecot service will be restarted automatically.

Two flaws were found in the way some settings were enforced by the script-login functionality of Dovecot. A remote, authenticated user could use these flaws to bypass intended access restrictions or conduct a directory traversal attack by leveraging login scripts.
(CVE-2011-2166, CVE-2011-2167)

A flaw was found in the way Dovecot performed remote server identity verification, when it was configured to proxy IMAP and POP3 connections to remote hosts using TLS/SSL protocols. A remote attacker could use this flaw to conduct man-in-the-middle attacks using an X.509 certificate issued by a trusted Certificate Authority (for a different name). (CVE-2011-4318)

This update also fixes the following bug :

  - When a new user first accessed their IMAP inbox, Dovecot     was, under some circumstances, unable to change the     group ownership of the inbox directory in the user's     Maildir location to match that of the user's mail spool     (/var/mail/$USER). This correctly generated an 'Internal     error occurred' message. However, with a subsequent     attempt to access the inbox, Dovecot saw that the     directory already existed and proceeded with its     operation, leaving the directory with incorrectly set     permissions. This update corrects the underlying     permissions setting error. When a new user now accesses     their inbox for the first time, and it is not possible     to set group ownership, Dovecot removes the created     directory and generates an error message instead of     keeping the directory with incorrect group ownership.

After installing the updated packages, the dovecot service will be restarted automatically.

It was discovered that Dovecot incorrectly validated certificate hostnames when being used as a POP3 and IMAP proxy. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75820	openSUSE Security Update : dovecot20 (openSUSE-SU-2012:0219-1)	Nessus	SuSE Local Security Checks	medium
74536	openSUSE Security Update : dovecot20 (openSUSE-2011-88)	Nessus	SuSE Local Security Checks	medium
68756	Oracle Linux 6 : dovecot (ELSA-2013-0520)	Nessus	Oracle Linux Local Security Checks	medium
65151	CentOS 6 : dovecot (CESA-2013:0520)	Nessus	CentOS Local Security Checks	medium
65009	Scientific Linux Security Update : dovecot on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	medium
64767	RHEL 6 : dovecot (RHSA-2013:0520)	Nessus	Red Hat Local Security Checks	medium
57059	Ubuntu 11.10 : dovecot vulnerability (USN-1295-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-4318

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium