Vulnerabilities > CVE-2019-3814 - Improper Certificate Validation vulnerability in multiple products

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2020 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(121604);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/20");

  script_cve_id("CVE-2019-3814");

  script_name(english:"FreeBSD : mail/dovecot -- Suitable client certificate can be used to login as other user (1340fcc1-2953-11e9-bc44-a4badb296695)");
  script_summary(english:"Checks for updated package in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote FreeBSD host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Aki Tuomi (Open-Xchange Oy) reports :

Normally Dovecot is configured to authenticate
imap/pop3/managesieve/submission clients using regular
username/password combination. Some installations have also required
clients to present a trusted SSL certificate on top of that. It's also
possible to configure Dovecot to take the username from the
certificate instead of from the user provided authentication. It's
also possible to avoid having a password at all, only trusting the SSL
certificate.

If the provided trusted SSL certificate is missing the username field,
Dovecot should be failing the authentication. However, the earlier
versions will take the username from the user provided authentication
fields (e.g. LOGIN command). If there is no additional password
verification, this allows the attacker to login as anyone else in the
system.

This affects only installations using :

auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes

Attacker must also have access to a valid trusted certificate without
the ssl_cert_username_field in it. The default is commonName, which
almost certainly exists in all certificates. This could happen for
example if ssl_cert_username_field is a field that normally doesn't
exist, and attacker has access to a web server's certificate (and
key), which is signed with the same CA.

Attack can be migitated by having the certificates with proper
Extended Key Usage, such as 'TLS Web Server' and 'TLS Web Server
Client'.

Also, ssl_cert_username_field setting was ignored with external SMTP
AUTH, because none of the MTAs (Postfix, Exim) currently send the
cert_username field. This may have allowed users with trusted
certificate to specify any username in the authentication. This does
not apply to Dovecot Submission service."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.mail-archive.com/[email protected]/msg76117.html"
  );
  # https://vuxml.freebsd.org/freebsd/1340fcc1-2953-11e9-bc44-a4badb296695.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?d9e599d0"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:dovecot");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/02/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/06");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"dovecot<2.3.4.1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2019:3467. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(130542);
  script_version("1.2");
  script_cvs_date("Date: 2019/12/17");

  script_cve_id("CVE-2019-3814");
  script_xref(name:"RHSA", value:"2019:3467");

  script_name(english:"RHEL 8 : dovecot (RHSA-2019:3467)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An update for dovecot is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security
impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

Dovecot is an IMAP server for Linux and other UNIX-like systems,
written primarily with security in mind. It also contains a small POP3
server, and supports e-mail in either the maildir or mbox format. The
SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es) :

* dovecot: Improper certificate validation (CVE-2019-3814)

For more details about the security issue(s), including the impact, a
CVSS score, acknowledgments, and other related information, refer to
the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.1 Release Notes linked from the References section."
  );
  # https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?774148ae"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2019:3467"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2019-3814"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-mysql-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-pgsql-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-pigeonhole");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:dovecot-pigeonhole-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/06");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 8.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2019:3467";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL8", cpu:"i686", reference:"dovecot-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"aarch64", reference:"dovecot-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"i686", reference:"dovecot-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"aarch64", reference:"dovecot-debugsource-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"i686", reference:"dovecot-debugsource-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-debugsource-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-debugsource-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"aarch64", reference:"dovecot-devel-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"i686", reference:"dovecot-devel-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-devel-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-devel-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-mysql-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-mysql-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"aarch64", reference:"dovecot-mysql-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"i686", reference:"dovecot-mysql-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-mysql-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-mysql-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-pgsql-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-pgsql-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"aarch64", reference:"dovecot-pgsql-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"i686", reference:"dovecot-pgsql-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-pgsql-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-pgsql-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-pigeonhole-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-pigeonhole-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"aarch64", reference:"dovecot-pigeonhole-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"i686", reference:"dovecot-pigeonhole-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"dovecot-pigeonhole-debuginfo-2.2.36-10.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"dovecot-pigeonhole-debuginfo-2.2.36-10.el8")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc");
  }
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2019-9e004decea.
#

include("compat.inc");

if (description)
{
  script_id(125910);
  script_version("1.3");
  script_cvs_date("Date: 2020/01/10");

  script_cve_id("CVE-2019-11494", "CVE-2019-11499", "CVE-2019-3814", "CVE-2019-7524");
  script_xref(name:"FEDORA", value:"2019-9e004decea");

  script_name(english:"Fedora 30 : 1:dovecot (2019-9e004decea)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"dovecot updated to 2.3.6, includes several security fixes

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2019-9e004decea"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected 1:dovecot package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:1:dovecot");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:30");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/06/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/14");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^30([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 30", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC30", reference:"dovecot-2.3.6-3.fc30", epoch:"1")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "1:dovecot");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(124376);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");

  script_cve_id(
    "CVE-2019-3814",
    "CVE-2019-7524"
  );

  script_name(english:"EulerOS 2.0 SP5 : dovecot (EulerOS-SA-2019-1280)");
  script_summary(english:"Checks the rpm output for the updated packages.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the dovecot packages installed, the
EulerOS installation on the remote host is affected by the following
vulnerabilities :

  - It was discovered that Dovecot incorrectly handled
    client certificates. A remote attacker in possession of
    a valid certificate with an empty username field could
    possibly use this issue to impersonate other
    users.(CVE-2019-3814)

  - In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a
    local attacker can cause a buffer overflow in the
    indexer-worker process, which can be used to elevate to
    root. This occurs because of missing checks in the fts
    and pop3-uidl components.(CVE-2019-7524)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1280
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ca21d234");
  script_set_attribute(attribute:"solution", value:
"Update the affected dovecot packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"patch_publication_date", value:"2019/04/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dovecot");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dovecot-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dovecot-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dovecot-pigeonhole");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["dovecot-2.2.10-8.h4.eulerosv2r7",
        "dovecot-mysql-2.2.10-8.h4.eulerosv2r7",
        "dovecot-pgsql-2.2.10-8.h4.eulerosv2r7",
        "dovecot-pigeonhole-2.2.10-8.h4.eulerosv2r7"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2019-243.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(122444);
  script_version("1.3");
  script_cvs_date("Date: 2020/02/07");

  script_cve_id("CVE-2019-3814");

  script_name(english:"openSUSE Security Update : dovecot23 (openSUSE-2019-243)");
  script_summary(english:"Check for the openSUSE-2019-243 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for dovecot23 fixes the following issues :

dovecot was updated to 2.3.3 release, bringing lots of bugfixes
(bsc#1124356).

Also the following security issue was fixed :

  - CVE-2019-3814: A vulnerability in Dovecot related to SSL
    client certificate authentication was fixed
    (bsc#1123022)

The package changes :

Updated pigeonhole to 0.5.3 :

  - Fix assertion panic occurring when managesieve service
    fails to open INBOX while saving a Sieve script. This
    was caused by a lack of cleanup after failure.

  - Fix specific messages causing an assert panic with
    actions that compose a reply (e.g. vacation). With some
    rather weird input from the original message, the header
    folding algorithm (as used for composing the References
    header for the reply) got confused, causing the panic.

  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT
    command parsing. After finishing reading the Sieve
    script, the command parsing sometimes didn't continue
    with the search arguments. This is a time- critical bug
    that likely only occurs when the Sieve script is sent in
    the next TCP frame.

dovecot23 was updated to 2.3.3 :

  - doveconf hides more secrets now in the default output.

  - ssl_dh setting is no longer enforced at startup. If it's
    not set and non-ECC DH key exchange happens, error is
    logged and client is disconnected.

  - Added log_debug=<filter> setting.

  - Added log_core_filter=<log filter> setting.

  - quota-clone: Write to dict asynchronously

  - --enable-hardening attempts to use retpoline Spectre 2
    mitigations

  - lmtp proxy: Support source_ip passdb extra field.

  - doveadm stats dump: Support more fields and output
    stddev by default.

  - push-notification: Add SSL support for OX backend.

  - NUL bytes in mail headers can cause truncated replies
    when fetched.

  - director: Conflicting host up/down state changes may in
    some rare situations ended up in a loop of two directors
    constantly overwriting each others' changes.

  - director: Fix hang/crash when multiple doveadm commands
    are being handled concurrently.

  - director: Fix assert-crash if doveadm disconnects too
    early

  - virtual plugin: Some searches used 100% CPU for many
    seconds

  - dsync assert-crashed with acl plugin in some situations.
    (bsc#1119850)

  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.

  - Mail snippet generation crashed with mails containing
    invalid Content-Type:multipart header.

  - Log prefix ordering was different for some log lines.

  - quota: With noenforcing option current quota usage
    wasn't updated.

  - auth: Kerberos authentication against Samba
    assert-crashed.

  - stats clients were unnecessarily chatty with the stats
    server.

  - imapc: Fixed various assert-crashes when reconnecting to
    server.

  - lmtp, submission: Fix potential crash if client
    disconnects while handling a command.

  - quota: Fixed compiling with glibc-2.26 / support
    libtirpc.

  - fts-solr: Empty search values resulted in 400 Bad
    Request errors

  - fts-solr: default_ns parameter couldn't be used

  - submission server crashed if relay server returned over
    7 lines in a reply (e.g. to EHLO)

dovecot was updated to 2.3.2.1 :

  - SSL/TLS servers may have crashed during client
    disconnection

  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may
    have sometimes assert-crashed.

  - v2.3.2: 'make check' may have crashed with 32bit systems

dovecot was updated to 2.3.2 :

  - old-stats plugin: Don't temporarily enable
    PR_SET_DUMPABLE while opening /proc/self/io. This may
    still cause security problems if the process is
    ptrace()d at the same time. Instead, open it while still
    running as root.

  - doveadm: Added mailbox cache decision&remove commands.
    See doveadm-mailbox(1) man page for details.

  - doveadm: Added rebuild attachments command for
    rebuilding $HasAttachment or $HasNoAttachment flags for
    matching mails. See doveadm-rebuild(1) man page for
    details.

  - cassandra: Use fallback_consistency on more types of
    errors

  - lmtp proxy: Support outgoing SSL/TLS connections

  - lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir
    settings.

  - submission: Add support for rawlog_dir

  - submission: Add submission_client_workarounds setting.

  - lua auth: Add password_verify() function and additional
    fields in auth request.

  - doveadm-server: TCP connections are hanging when there
    is a lot of network output. This especially caused hangs
    in dsync-replication.

  - Using multiple type=shared mdbox namespaces crashed

  - mail_fsync setting was ignored. It was always set to
    'optimized'.

  - lua auth: Fix potential crash at deinit

  - SSL/TLS servers may have crashed if client disconnected
    during handshake.

  - SSL/TLS servers: Don't send extraneous certificates to
    client when alt certs are used.

  - lda, lmtp: Return-Path header without '<' may have
    assert-crashed.

  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash

  - lda: -f parameter didn't allow empty/null/domainless
    address

  - lmtp, submission: Message size limit was hardcoded to 40
    MB. Exceeding it caused the connection to get dropped
    during transfer.

  - lmtp: Fix potential crash when delivery fails at DATA
    stage

  - lmtp: login_greeting setting was ignored

  - Fix to work with OpenSSL v1.0.2f

  - systemd unit restrictions were too strict by default

  - Fix potential crashes when a lot of log output was
    produced

  - SMTP client may have assert-crashed when sending mail

  - IMAP COMPRESS: Send 'end of compression' marker when
    disconnecting.

  - cassandra: Fix consistency=quorum to work

  - dsync: Lock file generation failed if home directory
    didn't exist

  - Snippet generation for HTML mails didn't ignore
    &entities inside blockquotes, producing strange looking
    snippets.

  - imapc: Fix assert-crash if getting disconnected and
    after reconnection all mails in the selected mailbox are
    gone.

  - pop3c: Handle unexpected server disconnections without
    assert-crash

  - fts: Fixes to indexing mails via virtual mailboxes.

  - fts: If mails contained NUL characters, the text around
    it wasn't indexed.

  - Obsolete dovecot.index.cache offsets were sometimes
    used. Trying to fetch a field that was just added to
    cache file may not have always found it.

pigeonhole was updated to 0.5.2 :

  - Implement plugin for the a vendor-defined IMAP
    capability called 'FILTER=SIEVE'. It adds the ability to
    manually invoke Sieve filtering in IMAP. More
    information can be found in
    doc/plugins/imap_filter_sieve.txt.

  - The Sieve addess test caused an assertion panic for
    invalid addresses with UTF-8 codepoints in the
    localpart. Fixed by properly detecting invalid addresses
    with UTF-8 codepoints in the localpart and skipping
    these like other invalid addresses while iterating
    addresses for the address test.

  - Make the length of the subject header for the vacation
    response configurable and enforce the limit in UTF-8
    codepoints rather than bytes. The subject header for a
    vacation response was statically truncated to 256 bytes,
    which is too limited for multi-byte UTF-8 characters.

  - Sieve editheader extension: Fix assertion panic
    occurring when it is used to manipulate a message header
    with a very large header field.

  - Properly abort execution of the sieve_discard script
    upon error. Before, the LDA Sieve plugin attempted to
    execute the sieve_discard script when an error occurs.
    This can lead to the message being lost.

  - Fix the interaction between quota and the sieve_discard
    script. When quota was used together with a
    sieve_discard script, the message delivery did not
    bounce when the quota was exceeded.

  - Fix crash for over quota users

This update was imported from the SUSE:SLE-15:Update update project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1119850"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1123022"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1124356"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected dovecot23 packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-backend-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-backend-mysql-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-fts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-fts-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-fts-lucene");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-fts-lucene-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-fts-solr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-fts-solr-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-fts-squat");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot23-fts-squat-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-backend-mysql-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-backend-mysql-debuginfo-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-backend-pgsql-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-backend-pgsql-debuginfo-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-backend-sqlite-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-backend-sqlite-debuginfo-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-debuginfo-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-debugsource-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-devel-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-fts-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-fts-debuginfo-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-fts-lucene-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-fts-lucene-debuginfo-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-fts-solr-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-fts-solr-debuginfo-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-fts-squat-2.3.3-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"dovecot23-fts-squat-debuginfo-2.3.3-lp150.3.3.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot23 / dovecot23-backend-mysql / etc");
}