oss-security - CVE? CCE? dovecot setting is often used incorrectly

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <47CDDE10.3000301@freethemallocs.com>
Date: Tue, 04 Mar 2008 14:41:04 -0900
From: Jonathan Smith <smithj@...ethemallocs.com>
To:  oss-security@...ts.openwall.com, 
 "Steven M. Christey" <coley@...us.mitre.org>
CC:  tss@....fi
Subject: CVE? CCE? dovecot setting is often used incorrectly

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've been trying to figure out what to do with this one. I'm not
inclined to believe it deserves a CVE given that it is configuration
(either dovecot config or filesystem permissions configuration). I read
once on mitre.org about "Common Configuration Enumeration" aka "CCE"
issues, but I've never seen them actually used. Maybe this is a good
candidate?

Steve, any ideas?

I've included the dovecot author in CC in case he has any input.

	smithj

- -------- Original Message --------
Subject: [Dovecot-news] Security issue #5: mail_extra_groups setting is
often used	insecurely
Date: Tue, 04 Mar 2008 08:35:47 +0200
From: Timo Sirainen <tss@....fi>
Reply-To: dovecot@...ecot.org
To: dovecot-news@...ecot.org
CC: Dovecot Mailing List <dovecot@...ecot.org>

mail_extra_groups=mail setting is often used insecurely to give Dovecot
access to create dotlocks to /var/mail directory. If you don't use
mboxes in /var/mail, make sure this setting is cleared.

If you do use /var/mail mboxes and Dovecot gives permission errors
without it, do one of the following (in the preferred order):

a) Upgrade to v1.0.11 and use the new mail_privileged_group setting
instead of mail_extra_groups.
b) Make /var/mail sticky and world-writable (chmod 01777 /var/mail) and
clear mail_extra_groups setting.
c) Make /var/mail sticky (chmod +t /var/mail) and keep mail_extra_groups
setting. This fixes the main problem but some may be left.

The mail_privileged_group setting is also available as a patch:
http://dovecot.org/patches/1.0/dovecot-1.0.10.mail_priv_groups.diff

mail_extra_groups setting has existed since Dovecot v0.99.10.6. It's
never been enabled by default in the distributed dovecot-example.conf,
but some distributions enable it by default (at least Debian).

A longer explanation:

The main problem is that if users have filesystem access to the mail
server, they can create symlinks. Dovecot doesn't try to prevent
following symlinks (and I don't think it should) and normally it isn't a
problem. But when mail_extra_groups=mail is set:

1a) Maildir: Any files readable by mail group can be read by the user by
symlinking the file to their ~/Maildir/cur/.

1b) Any mbox files readable by mail group can be read by the user by
symlinking the mbox file to their ~/mail/ directory.

These are pretty obvious problems and I didn't think they were all that
important. Why would anyone have secret files that are mail
group-readable? But apparently those do exist in some systems (maybe
accidentally).

2a) mbox: Any files/directories under mail group-writable directories
can be created/deleted/renamed by symlinking the directory under
~/mail/. For example ln -s /var/mail ~/mail/var, DELETE var/root will
happily delete root's mailbox. This I hadn't thought about before.

2b) Maildir: Pretty much the same thing can be done with maildir but
with a little less control.

mail_privileged_group setting works by keeping the group in process's
saved GID while it's not in use and temporarily switching it to
effective GID while dotlocks are created. Currently this is done only
when:

1. It's only done for INBOX mbox which doesn't exist under the same
location as other mailboxes (so typically under /var/mail).

2. It's used only after initial dotlock creation try failed with EACCES
error.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.8 (GNU/Linux)

iEYEARECAAYFAkfN3hAACgkQCG91qXPaRen04gCgj4VoQ9Lu02irXftlYpTAywmo
xvwAnRNAyqlkTdk7JSIg7tUHwPAXFM3G
=AXwB
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.