Dovecot up to 1.2.7 on Exim Input Sanitizer MAIL FROM privileges management

Summaryinfo

A vulnerability was found in Dovecot up to 1.2.7 on Exim. It has been rated as critical. The affected element is an unknown function of the component Input Sanitizer. Performing a manipulation of the argument MAIL FROM results in privileges management. Moreover, an exploit is present. It is recommended to change the configuration settings.

Detailsinfo

A vulnerability was found in Dovecot up to 1.2.7 on Exim (Mail Server Software). It has been classified as critical. This affects an unknown function of the component Input Sanitizer. The manipulation of the argument MAIL FROM with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The bug was discovered 03/05/2003. The weakness was disclosed 05/03/2013 with RedTeam Pentesting GmbH as t-sa-2013-001 as not defined advisory (Website). It is possible to read the advisory at redteam-pentesting.de. The exploitability is told to be easy. It is possible to initiate the attack remotely. The successful exploitation requires a authentication. Technical details and a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

After immediately, there has been an exploit disclosed. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 59 days. During that time the estimated underground price was around $0-$5k.

It is possible to mitigate the problem by applying the configuration setting Remove 'use_shell' Option. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (25297) and OSVDB (93004†). Further details are available at exploit-db.com. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Mail Server Software

Name

• Dovecot

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion