oss-security - CVE request: dovecot unauthorized login

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <47D3DE63.60307@freethemallocs.com>
Date: Sun, 09 Mar 2008 04:56:03 -0800
From: Jonathan Smith <smithj@...ethemallocs.com>
To:  oss-security@...ts.openwall.com, 
 "Steven M. Christey" <coley@...re.org>
Subject: CVE request: dovecot unauthorized login

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

thanks in advance

	smithj

- -------- Original Message --------
Subject: [Dovecot-news] Security hole #6: Some passdbs allowed users
to log	in without a	valid password
Date: Sun, 09 Mar 2008 13:09:44 +0200
From: Timo Sirainen <tss@....fi>
Reply-To: dovecot@...ecot.org
To: Dovecot News List <dovecot-news@...ecot.org>
CC: Dovecot Mailing List <dovecot@...ecot.org>

This affects only blocking passdbs:

~ - MySQL
~ - PAM, passwd and shadow if blocking=yes

The underlying bug exists in all v1.0.x versions, but I couldn't figure
out a way to exploit it except with v1.0.11, v1.0.12 and v1.1.rc2.
Probably a good idea to upgrade in any case.

The main problem is that Dovecot's internal protocols use TAB character
as a delimiter, but passwords were sent unescaped through them. So
passwords containing TAB characters allowed to add new internal fields.
The main problem here is a new "skip_password_check" field added in
v1.0.11 to fix problems with master user logins. Specifying this field
allowed the user to skip the password check, as the name implies.

This has been fixed thoroughly in v1.0.13 and v1.1.rc3 to make sure
there are no more escaping problems with any fields, but it can be also
fixed with a less intrusive patch for v1.0:
http://hg.dovecot.org/dovecot-1.0/raw-rev/da2a9372e26e

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.8 (GNU/Linux)

iEYEARECAAYFAkfT3mMACgkQCG91qXPaRekffQCfcPE7qjToe47c1L3nm5G1RVzZ
TdQAoKcLV5Gad5pEb3nF6729eprEtdPY
=kt8p
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.