BID:28181

Dovecot 'Tab' Character Password Check Security Bypass Vulnerability

Info

Dovecot 'Tab' Character Password Check Security Bypass Vulnerability

Bugtraq ID:	28181
Class:	Input Validation Error
CVE:	CVE-2008-1218
Remote:	Yes
Local:	No
Published:	Mar 10 2008 12:00AM
Updated:	Apr 16 2015 06:12PM
Credit:	The vendor reported this issue.
Vulnerable:	Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE openSUSE 10.3 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.2 rPath rPath Linux 1 Red Hat Fedora 7 Gentoo Linux 2007.0 Gentoo Linux Dovecot Dovecot 1.0.12 Dovecot Dovecot 1.0.11 Dovecot Dovecot 1.0.10 Dovecot Dovecot 1.0.9 Dovecot Dovecot 1.0.8 Dovecot Dovecot 1.0.7 Dovecot Dovecot 1.0.6 Dovecot Dovecot 1.0.5 Dovecot Dovecot 1.0.4 Dovecot Dovecot 1.0.3 Dovecot Dovecot 0.99.14 Dovecot Dovecot 0.99.13 Dovecot Dovecot 0.99.10 .6 Dovecot Dovecot 1.1rc2 Dovecot Dovecot 1.0.RC9 Dovecot Dovecot 1.0.RC8 Dovecot Dovecot 1.0.RC7 Dovecot Dovecot 1.0.RC6 Dovecot Dovecot 1.0.RC5 Dovecot Dovecot 1.0.RC4 Dovecot Dovecot 1.0.RC3 Dovecot Dovecot 1.0.RC2 Dovecot Dovecot 1.0.RC15 Dovecot Dovecot 1.0.RC14 Dovecot Dovecot 1.0.RC13 Dovecot Dovecot 1.0.RC12 Dovecot Dovecot 1.0.RC11 Dovecot Dovecot 1.0.RC10 Dovecot Dovecot 1.0.rc1 Dovecot Dovecot 1.0.beta3 Dovecot Dovecot 1.0.Beta2 Dovecot Dovecot 1.0 rc29 Dovecot Dovecot 1.0 beta8 Dovecot Dovecot 1.0 beta7 Dovecot Dovecot 1.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0

Not Vulnerable:	Dovecot Dovecot 1.0.13 Dovecot Dovecot 1.1rc3

Discussion

Dovecot 'Tab' Character Password Check Security Bypass Vulnerability

Dovecot is prone to a security-bypass vulnerability because the application fails to adequately sanitize user-supplied input.

An attacker may exploit this issue to gain unauthorized access the affected application. Successful exploits will compromise the application.

Versions prior to Dovecot 1.0.13 and 1.1.rc3 are vulnerable. The vendor states that this issue affects only password databases that have blocking enabled.

NOTE: Reports indicate that this issue can be exploited only on versions after Dovecot 1.0.10, which introduced the 'skip_password_check' field.

Exploit / POC

Dovecot 'Tab' Character Password Check Security Bypass Vulnerability

An attacker can exploit this issue using standard client applications.

The following exploit is available:

/data/vulnerabilities/exploits/28181.py

Solution / Fix

Dovecot 'Tab' Character Password Check Security Bypass Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Dovecot Dovecot 1.0.RC11