Date: Sun, 09 Mar 2008 04:56:03 -0800 From: Jonathan Smith <smithj@...ethemallocs.com> To: oss-security@...ts.openwall.com, "Steven M. Christey" <coley@...re.org> Subject: CVE request: dovecot unauthorized login -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 thanks in advance smithj - -------- Original Message -------- Subject: [Dovecot-news] Security hole #6: Some passdbs allowed users to log in without a valid password Date: Sun, 09 Mar 2008 13:09:44 +0200 From: Timo Sirainen <tss@....fi> Reply-To: dovecot@...ecot.org To: Dovecot News List <dovecot-news@...ecot.org> CC: Dovecot Mailing List <dovecot@...ecot.org> This affects only blocking passdbs: ~ - MySQL ~ - PAM, passwd and shadow if blocking=yes The underlying bug exists in all v1.0.x versions, but I couldn't figure out a way to exploit it except with v1.0.11, v1.0.12 and v1.1.rc2. Probably a good idea to upgrade in any case. The main problem is that Dovecot's internal protocols use TAB character as a delimiter, but passwords were sent unescaped through them. So passwords containing TAB characters allowed to add new internal fields. The main problem here is a new "skip_password_check" field added in v1.0.11 to fix problems with master user logins. Specifying this field allowed the user to skip the password check, as the name implies. This has been fixed thoroughly in v1.0.13 and v1.1.rc3 to make sure there are no more escaping problems with any fields, but it can be also fixed with a less intrusive patch for v1.0: http://hg.dovecot.org/dovecot-1.0/raw-rev/da2a9372e26e -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.8 (GNU/Linux) iEYEARECAAYFAkfT3mMACgkQCG91qXPaRekffQCfcPE7qjToe47c1L3nm5G1RVzZ TdQAoKcLV5Gad5pEb3nF6729eprEtdPY =kt8p -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.