CVE-2016-4983: Low severity dovecot vulnerability
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
Other sources
Kurt Seifried of Red Hat reports:
The dovecot rpm creates the SSL/TLS key files using the following rpm postinstall script in RHEL 4:
create a ssl cert if [ ! -f /usr/share/ssl/certs/dovecot.pem ]; then pushd /usr/share/ssl &>/dev/null umask 077 cat << EOF | openssl req -new -x509 -days 365 -nodes -out certs/dovecot.pem -keyout private/dovecot.pem &>/dev/null -- SomeState SomeCity SomeOrganization SomeOrganizationalUnit localhost.localdomain root EOF chown root:root private/dovecot.pem certs/dovecot.pem chmod 600 private/dovecot.pem certs/dovecot.pem
And later versions use a postinstall of:
generate the ssl certificates if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; then SSLDIR=/etc/pki/dovecot OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf \ /usr/libexec/dovecot/mkcert.sh &> /dev/null fi
from: /usr/libexec/dovecot/mkcert.sh
$OPENSSL req -new -x509 -nodes -config $OPENSSLCONFIG -out $CERTFILE -keyout $KEYFILE -days 365 || exit 2 chown root:root $CERTFILE $KEYFILE chmod 0600 $CERTFILE $KEYFILE
this can lead to the contents of the file being exposed between the time the file is created and the chmod command runs. I would suggest setting umask 077 first.
Additionally this secret value needs to be unique per instance or install but this value is created at install-time and not during the first run. All container and image instances created would share the same password as this password is set at rpm install time, and each instance should recieve a unique password.
This bug is being file because Product Security considers "first run problems" to be bugs with the source package and with the container or image only in the aggregate. This view is in collaboration with upstream Fedora. See: https://fedorahosted.org/fpc/ticket/506
The recommended resolution for services is to follow the "First-time Service Setup" pattern (see: https://fedoraproject.org/wiki/Packaging:InitialServiceSetup ). Other packages may should use a runtime check and generation or similar procedure.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4983?
CVE-2016-4983 has a medium severity rating, as it allows local users to access sensitive SSL/TLS key files.
How do I mitigate CVE-2016-4983?
Mitigation for CVE-2016-4983 involves adjusting file permissions and ownership for SSL/TLS key files created by dovecot.
Which systems are affected by CVE-2016-4983?
CVE-2016-4983 affects certain versions of Dovecot on Red Hat Enterprise Linux and openSUSE distributions.
Can exploiting CVE-2016-4983 lead to unauthorized access?
Yes, exploiting CVE-2016-4983 can allow local users to read private SSL/TLS key files, potentially leading to unauthorized access.
What versions of Red Hat are impacted by CVE-2016-4983?
CVE-2016-4983 impacts Red Hat Enterprise Linux versions 4.0, 5.0, 6.0, and 7.0.