[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <788268192.590651259002647709.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 23 Nov 2009 13:57:27 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: v1.2.8 released to fix the 0777
base_dir creation issue
Please use CVE-2009-3897 for this.
Thanks.
--
JB
----- "Thomas Biege" <thomas@...e.de> wrote:
> Hello.
>
> http://www.dovecot.org/list/dovecot-news/2009-November/000143.html
>
> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz
> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sig
>
> This is mainly to fix the 0777 base_dir creation issue, which could
> be
> considered a security hole, exploitable by local users. An attacker
> could for example replace Dovecot's auth socket and log in as other
> users. Gaining root privileges isn't possible though.
>
> This affects only v1.2 users, v1.1 and older versions were creating
> the
> directory with 0755 permission.
>
> If your Dovecot's base_dir isn't in /var/run/dovecot/, you should
> also
> make sure that the $prefix/var/ and $prefix/var/run/
> (i.e. /usr/local/var/, /usr/local/var/run/ by default) aren't 0777.
>
> * Dovecot v1.2.x had been creating base_dir (and its parents if
> necessary) with 0777 permissions. The base_dir's permissions get
> changed to 0755 automatically at startup, but you may need to
> chmod the parent directories manually.
>
> - acl: If user has rights from more than one group, merge them
> instead
> of choosing one group's rights and ignoring others.
> - virtual: When using a lot of mailboxes, the virtual mailbox's
> header
> could have grown over 32 kB and caused "out of memory" crashes.
> Also
> over 64 kB headers couldn't even be updated with existing
> transaction
> log records. Added a new record type that gets used with >=64 kB
> headers. Older Dovecot versions don't understand this header and
> will log errors if they see it.
> - FETCH BODYSTRUCTURE didn't return RFC 2231 "key*" fields correctly
>
>
> --
> Bye,
> Thomas
> --
> Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support &
> Auditing
> SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
> --
> Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
> -- Marie von Ebner-Eschenbach
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
