Quote:Researchers warn hackers can snoop on email messages by exploiting a bug in the underlying technology used by the majority of email servers that run the Internet Message Access Protocol, commonly referred to as IMAP. The bug, first reported in August 2020 and patched Monday, is tied to the email server software Dovecot, used by over three-quarters of IMAP servers, according to Open Email Survey.
 
The vulnerability opens the door to what is called a meddle-in-the-middle (MITM) attack, according to a report by researchers Fabian Ising and Damian Poddebniak, with Münster University of Applied Sciences, based in Germany.
 
“The vulnerability allows a MITM attacker between a mail client and Dovecot to inject unencrypted commands into the encrypted TLS context, redirecting user credentials and mails to the attacker,” according to research linked to from a bug bounty page and dated August 2020.
 
A patch for the vulnerability, rated by the vendor as -severity and by the third-party security firm Tenable as critical, is available for download in the form of Dovecot version v2.3.14.1.
 
The flaw centers around the implementation of the email instruction called START-TLS, a command issued between an email program and server that’s designed to secure the delivery of email messages, according to a technical description by Anubisnetworks.
 
“We found that Dovecot is affected by a command injection issue in START-TLS. This bug allows [an attacker] to bypass security features of SMTP such as the blocking of plaintext logins. Furthermore, it allows [an attacker] to mount a session fixation attack, which possibly results in stealing of credentials such as the SMTP username and password,” researchers wrote.