Skip to navigation

Security Advisory Low: dovecot security and bug fix update

Advisory: RHSA-2013:0520-2
Type: Security Advisory
Severity: Low
Issued on: 2013-02-21
Last updated on: 2013-02-21
Affected Products: Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Workstation (v. 6)
CVEs (cve.mitre.org): CVE-2011-2166
CVE-2011-2167
CVE-2011-4318

Details

Updated dovecot packages that fix three security issues and one bug are now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Dovecot is an IMAP server, written with security primarily in mind, for
Linux and other UNIX-like systems. It also contains a small POP3 server. It
supports mail in either of maildir or mbox formats. The SQL drivers and
authentication plug-ins are provided as sub-packages.

Two flaws were found in the way some settings were enforced by the
script-login functionality of Dovecot. A remote, authenticated user could
use these flaws to bypass intended access restrictions or conduct a
directory traversal attack by leveraging login scripts. (CVE-2011-2166,
CVE-2011-2167)

A flaw was found in the way Dovecot performed remote server identity
verification, when it was configured to proxy IMAP and POP3 connections to
remote hosts using TLS/SSL protocols. A remote attacker could use this flaw
to conduct man-in-the-middle attacks using an X.509 certificate issued by
a trusted Certificate Authority (for a different name). (CVE-2011-4318)

This update also fixes the following bug:

* When a new user first accessed their IMAP inbox, Dovecot was, under some
circumstances, unable to change the group ownership of the inbox directory
in the user's Maildir location to match that of the user's mail spool
(/var/mail/$USER). This correctly generated an "Internal error occurred"
message. However, with a subsequent attempt to access the inbox, Dovecot
saw that the directory already existed and proceeded with its operation,
leaving the directory with incorrectly set permissions. This update
corrects the underlying permissions setting error. When a new user now
accesses their inbox for the first time, and it is not possible to set
group ownership, Dovecot removes the created directory and generates an
error message instead of keeping the directory with incorrect group
ownership. (BZ#697620)

Users of dovecot are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. After installing the
updated packages, the dovecot service will be restarted automatically.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Enterprise Linux Server (v. 6)

SRPMS:
dovecot-2.0.9-5.el6.src.rpm
File outdated by:  RHBA-2013:1736
    MD5: 89245d77546d6b5647523e1c7b06b78b
SHA-256: 0115dee9ea62615eabcc8c64c02a7b71c9f2ce97b816281450ef6c76d2098819
 
IA-32:
dovecot-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: 6fa865b9bb0ef19021d7164f30ed7d87
SHA-256: 8abf196f58e552cfa545e1d34592840149a20339887c516fc45d57c8c4d7705c
dovecot-debuginfo-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: e19f3542141c5a37861303c4e4661c84
SHA-256: 888455348ef67cf50407f27b5739f64ee048c94bbc327e0a3f68f56e1b6da759
dovecot-devel-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: 8fa86c0939e22d3e5fc7a2216fbd7409
SHA-256: 8a52547acec56c8ee20b1629b3223c7956322907279f5eafd467a688d110c604
dovecot-mysql-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: 30314e2c267de7267e2d1132f4c1966e
SHA-256: 5fe5a0cf66f97b20833326dd713c0ea6c74bc18c486d300ae664df28aa92fad9
dovecot-pgsql-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: dfe460a3870cd87c6eebb25f793e80ca
SHA-256: c6d2dd36d024a49d2240605d625b3b1c5563897b9d8b65aeedc25d454de86a72
dovecot-pigeonhole-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: b721866221c60b6f987eced43ee72e01
SHA-256: 1bc097e15a23a9acad1698f9a301b223c5e110b02a05c77f8728bae033eb80bb
 
PPC:
dovecot-2.0.9-5.el6.ppc.rpm
File outdated by:  RHBA-2013:1736
    MD5: 95429288a7ac0c4b1974254bc90bd7ae
SHA-256: 7a2f4a9394082e5d503fd43a82de77d031653dfa6e579d4ba7ed0bb782848a0c
dovecot-2.0.9-5.el6.ppc64.rpm
File outdated by:  RHBA-2013:1736
    MD5: d8692c1c4691bc69b1103b11cc399102
SHA-256: 08b168f082c98f14d96da1c1a7dc65e44ae325844a886eaef3aceac534a249de
dovecot-debuginfo-2.0.9-5.el6.ppc.rpm
File outdated by:  RHBA-2013:1736
    MD5: ab786c11e7d4b04f91858e0a2c88365d
SHA-256: 98c557203565f0665d07737b77ff52905e8410a08a0b5a3d36c6c2e77104ac80
dovecot-debuginfo-2.0.9-5.el6.ppc64.rpm
File outdated by:  RHBA-2013:1736
    MD5: c10fa60af8b93389eabaa6018722ca3f
SHA-256: 1ee13639b497ecacdd1411bda65e00a1ce356798b98a2be3d5b21e6fcddabec2
dovecot-devel-2.0.9-5.el6.ppc64.rpm
File outdated by:  RHBA-2013:1736
    MD5: a7e9c9ab5b4606af9012fe84296a9229
SHA-256: c9d6f1b3abee0d4b4fe0f2ac372d00023ac766dc336f2a0426f35037bac2d6b9
dovecot-mysql-2.0.9-5.el6.ppc64.rpm
File outdated by:  RHBA-2013:1736
    MD5: e0cfce0878a461ff3a008239416028ba
SHA-256: 1d8ce9b3dad2ff1c7a087f1a316ec659dff8d4de0884073cd67d651946beb1ea
dovecot-pgsql-2.0.9-5.el6.ppc64.rpm
File outdated by:  RHBA-2013:1736
    MD5: 5f8ae787897582b71b2c4dc3c5a533e5
SHA-256: 2756a31d809a10c48a599ed45da41ddf0eff519e12432a50ff12e4e9613e67e1
dovecot-pigeonhole-2.0.9-5.el6.ppc64.rpm
File outdated by:  RHBA-2013:1736
    MD5: a7d1576f86d34843c52e5b31907a6713
SHA-256: 2ecd9b63046d0122c0d83e7e9dbdcf768fac75e4c1b7bc8b54ba20e864e584e5
 
s390x:
dovecot-2.0.9-5.el6.s390.rpm
File outdated by:  RHBA-2013:1736
    MD5: b153b6bd9e00c69286854a1ce260a595
SHA-256: de7965e1563d435dde71ba71b0be6c4a4f94905ed06bfcfb570c5d7b247eeca4
dovecot-2.0.9-5.el6.s390x.rpm
File outdated by:  RHBA-2013:1736
    MD5: 300dd8d89c3ff673f60a9d2c12d4cee0
SHA-256: c8602f2530f2ac6bca996bb2e6800f030678baef86afde05852853c5a2dcec49
dovecot-debuginfo-2.0.9-5.el6.s390.rpm
File outdated by:  RHBA-2013:1736
    MD5: 19c7d8fb11fcd471301db3fe6c310725
SHA-256: 91133e62b7228ccd57e056d8285b2056a77ec46139c7325cd8dbc32008d77703
dovecot-debuginfo-2.0.9-5.el6.s390x.rpm
File outdated by:  RHBA-2013:1736
    MD5: 6ef2f416fed86df10e5b2382d564218e
SHA-256: 83e3c5b5bba97e58f1636748240d012183dd34e7ac22b6105bf282ac3b782c31
dovecot-devel-2.0.9-5.el6.s390x.rpm
File outdated by:  RHBA-2013:1736
    MD5: a5e2a60625eaba582ff8ad87e69a5c9d
SHA-256: 037d6dc00c21813e4adf85fecb1fcb0d0fcf66fd56e9f4ae87e0be6ce45dc604
dovecot-mysql-2.0.9-5.el6.s390x.rpm
File outdated by:  RHBA-2013:1736
    MD5: 37ae1d54ad900a22e96eb7e0fe6787a9
SHA-256: baedbbbc08b6e92d65571830877506244a25076f8d853485a0ae2b1a4c36349f
dovecot-pgsql-2.0.9-5.el6.s390x.rpm
File outdated by:  RHBA-2013:1736
    MD5: cf300829b626ba852d3012a82cfeb46c
SHA-256: b3c2747bc2fd15abe8c94760c642ae01bda0a74c19e6bfe751a832bd7aa9236c
dovecot-pigeonhole-2.0.9-5.el6.s390x.rpm
File outdated by:  RHBA-2013:1736
    MD5: 6006e6aef6ea37e69ce52a22b7ecd5a5
SHA-256: b08b192454f641da5263a9d0140410d973badef75947ce75626b2b8d713f43be
 
x86_64:
dovecot-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: 6fa865b9bb0ef19021d7164f30ed7d87
SHA-256: 8abf196f58e552cfa545e1d34592840149a20339887c516fc45d57c8c4d7705c
dovecot-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: dbea73f04f4d1870ae38896bb1f240a1
SHA-256: 88de31d610aee4ccc2f35f8c34e08564b6e28fc38eeddf8bb77db978ba3747b6
dovecot-debuginfo-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: e19f3542141c5a37861303c4e4661c84
SHA-256: 888455348ef67cf50407f27b5739f64ee048c94bbc327e0a3f68f56e1b6da759
dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: bcaedf7e98342de8e34632378c1ed75a
SHA-256: 02fc55077a909b97a0f726195a8bfd20d0e14014af43521f2cac63e986e36440
dovecot-devel-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: ac20c6d0325837af8a40503085538012
SHA-256: 3eee951256aae1b094354e811a7e9997b5ad6775126af10c8b639eef126bc0a5
dovecot-mysql-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: 867c0a83814a1e5a975f48781d0f86ce
SHA-256: 6d6f6487551d334ebba0759068166a885a1bc00d3d804a2fca9974eeede85718
dovecot-pgsql-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: d473720250cfc53335d0cead4885112b
SHA-256: e4dc99adef136703b1591534afd7d013bcc8a3d5bde44c513de4ea3f85c0bf61
dovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: f15864a2b91eefdf6d56a26568e71676
SHA-256: c5869b573c66c627af276638a8434efac979d0b7efb47cd317fa5d2102d14efc
 
Red Hat Enterprise Linux Workstation (v. 6)

SRPMS:
dovecot-2.0.9-5.el6.src.rpm
File outdated by:  RHBA-2013:1736
    MD5: 89245d77546d6b5647523e1c7b06b78b
SHA-256: 0115dee9ea62615eabcc8c64c02a7b71c9f2ce97b816281450ef6c76d2098819
 
IA-32:
dovecot-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: 6fa865b9bb0ef19021d7164f30ed7d87
SHA-256: 8abf196f58e552cfa545e1d34592840149a20339887c516fc45d57c8c4d7705c
dovecot-debuginfo-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: e19f3542141c5a37861303c4e4661c84
SHA-256: 888455348ef67cf50407f27b5739f64ee048c94bbc327e0a3f68f56e1b6da759
dovecot-devel-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: 8fa86c0939e22d3e5fc7a2216fbd7409
SHA-256: 8a52547acec56c8ee20b1629b3223c7956322907279f5eafd467a688d110c604
dovecot-mysql-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: 30314e2c267de7267e2d1132f4c1966e
SHA-256: 5fe5a0cf66f97b20833326dd713c0ea6c74bc18c486d300ae664df28aa92fad9
dovecot-pgsql-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: dfe460a3870cd87c6eebb25f793e80ca
SHA-256: c6d2dd36d024a49d2240605d625b3b1c5563897b9d8b65aeedc25d454de86a72
dovecot-pigeonhole-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: b721866221c60b6f987eced43ee72e01
SHA-256: 1bc097e15a23a9acad1698f9a301b223c5e110b02a05c77f8728bae033eb80bb
 
x86_64:
dovecot-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: 6fa865b9bb0ef19021d7164f30ed7d87
SHA-256: 8abf196f58e552cfa545e1d34592840149a20339887c516fc45d57c8c4d7705c
dovecot-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: dbea73f04f4d1870ae38896bb1f240a1
SHA-256: 88de31d610aee4ccc2f35f8c34e08564b6e28fc38eeddf8bb77db978ba3747b6
dovecot-debuginfo-2.0.9-5.el6.i686.rpm
File outdated by:  RHBA-2013:1736
    MD5: e19f3542141c5a37861303c4e4661c84
SHA-256: 888455348ef67cf50407f27b5739f64ee048c94bbc327e0a3f68f56e1b6da759
dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: bcaedf7e98342de8e34632378c1ed75a
SHA-256: 02fc55077a909b97a0f726195a8bfd20d0e14014af43521f2cac63e986e36440
dovecot-devel-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: ac20c6d0325837af8a40503085538012
SHA-256: 3eee951256aae1b094354e811a7e9997b5ad6775126af10c8b639eef126bc0a5
dovecot-mysql-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: 867c0a83814a1e5a975f48781d0f86ce
SHA-256: 6d6f6487551d334ebba0759068166a885a1bc00d3d804a2fca9974eeede85718
dovecot-pgsql-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: d473720250cfc53335d0cead4885112b
SHA-256: e4dc99adef136703b1591534afd7d013bcc8a3d5bde44c513de4ea3f85c0bf61
dovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm
File outdated by:  RHBA-2013:1736
    MD5: f15864a2b91eefdf6d56a26568e71676
SHA-256: c5869b573c66c627af276638a8434efac979d0b7efb47cd317fa5d2102d14efc
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

709095 - CVE-2011-2166 dovecot: authenticated remote bypass of intended access restrictions
709097 - CVE-2011-2167 dovecot: directory traversal due to not obeying chroot directive
754980 - CVE-2011-4318 dovecot: proxy destination host name not checked against SSL certificate name


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/