Debian Bug report logs - #469457
dovecot-imapd: allows to read other users' mboxes in /var/mail

version graph

Package: dovecot-imapd; Maintainer for dovecot-imapd is Dovecot Maintainers <jaldhar-dovecot@debian.org>; Source for dovecot-imapd is src:dovecot.

Reported by: Jeremie Bouttier <bouttier@spht.saclay.cea.fr>

Date: Wed, 5 Mar 2008 10:39:02 UTC

Severity: grave

Tags: patch, security

Fixed in version dovecot/1:1.0.12-1

Done: Fabio Tranchitella <kobold@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian Security Team <team@security.debian.org>, Dovecot Maintainers <jaldhar-dovecot@debian.org>:
Bug#469457; Package dovecot-imapd. Full text and rfc822 format available.

Acknowledgement sent to Jeremie Bouttier <bouttier@spht.saclay.cea.fr>:
New Bug report received and forwarded. Copy sent to Debian Security Team <team@security.debian.org>, Dovecot Maintainers <jaldhar-dovecot@debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Jeremie Bouttier <bouttier@spht.saclay.cea.fr>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: dovecot-imapd: allows to read other users' mboxes in /var/mail
Date: Wed, 05 Mar 2008 11:30:51 +0100
Package: dovecot-imapd
Severity: critical
Tags: security
Justification: root security hole

I believe all versions of Dovecot in Debian are concerned by this warning : 
http://dovecot.org/list/dovecot/2008-March/029196.html
On fairly standard Debian installations (Etch & Lenny) with mail delivered in 
/var/mail I was able to read other users' mboxes through a symlink in ~/Mail.

-- System Information:
Debian Release: lenny/sid
  APT prefers testing
  APT policy: (900, 'testing'), (900, 'stable'), (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.24-1-686 (SMP w/2 CPU cores)
Locale: LANG=fr_FR@euro, LC_CTYPE=fr_FR@euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Versions of packages dovecot-imapd depends on:
pn  dovecot-common                <none>     (no description available)
ii  libc6                         2.7-6      GNU C Library: Shared libraries
ii  libssl0.9.8                   0.9.8g-4   SSL shared libraries

dovecot-imapd recommends no packages.




Information forwarded to debian-bugs-dist@lists.debian.org, Dovecot Maintainers <jaldhar-dovecot@debian.org>:
Bug#469457; Package dovecot-imapd. Full text and rfc822 format available.

Acknowledgement sent to Nico Golde <nion@debian.org>:
Extra info received and forwarded to list. Copy sent to Dovecot Maintainers <jaldhar-dovecot@debian.org>. Full text and rfc822 format available.

Message #10 received at 469457@bugs.debian.org (full text, mbox):

From: Nico Golde <nion@debian.org>
To: 469457@bugs.debian.org
Subject: Re: dovecot-imapd: allows to read other users' mboxes in /var/mail
Date: Thu, 6 Mar 2008 11:24:01 +0100
[Message part 1 (text/plain, inline)]
tags 469457 + patch
severity 469457 grave
thanks

Hi,
you can find a patch for this on:
http://dovecot.org/patches/1.0/dovecot-1.0.10.mail_priv_groups.diff
Cheers
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
[Message part 2 (application/pgp-signature, inline)]

Tags added: patch Request was from Nico Golde <nion@debian.org> to control@bugs.debian.org. (Thu, 06 Mar 2008 10:27:04 GMT) Full text and rfc822 format available.

Severity set to `grave' from `critical' Request was from Nico Golde <nion@debian.org> to control@bugs.debian.org. (Thu, 06 Mar 2008 10:27:05 GMT) Full text and rfc822 format available.

Reply sent to Fabio Tranchitella <kobold@debian.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Jeremie Bouttier <bouttier@spht.saclay.cea.fr>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #19 received at 469457-close@bugs.debian.org (full text, mbox):

From: Fabio Tranchitella <kobold@debian.org>
To: 469457-close@bugs.debian.org
Subject: Bug#469457: fixed in dovecot 1:1.0.12-1
Date: Thu, 06 Mar 2008 16:17:09 +0000
Source: dovecot
Source-Version: 1:1.0.12-1

We believe that the bug you reported is fixed in the latest version of
dovecot, which is due to be installed in the Debian FTP archive:

dovecot-common_1.0.12-1_amd64.deb
  to pool/main/d/dovecot/dovecot-common_1.0.12-1_amd64.deb
dovecot-dev_1.0.12-1_amd64.deb
  to pool/main/d/dovecot/dovecot-dev_1.0.12-1_amd64.deb
dovecot-imapd_1.0.12-1_amd64.deb
  to pool/main/d/dovecot/dovecot-imapd_1.0.12-1_amd64.deb
dovecot-pop3d_1.0.12-1_amd64.deb
  to pool/main/d/dovecot/dovecot-pop3d_1.0.12-1_amd64.deb
dovecot_1.0.12-1.diff.gz
  to pool/main/d/dovecot/dovecot_1.0.12-1.diff.gz
dovecot_1.0.12-1.dsc
  to pool/main/d/dovecot/dovecot_1.0.12-1.dsc
dovecot_1.0.12.orig.tar.gz
  to pool/main/d/dovecot/dovecot_1.0.12.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 469457@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Fabio Tranchitella <kobold@debian.org> (supplier of updated dovecot package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Thu, 06 Mar 2008 15:53:07 +0100
Source: dovecot
Binary: dovecot-common dovecot-dev dovecot-imapd dovecot-pop3d
Architecture: source amd64
Version: 1:1.0.12-1
Distribution: unstable
Urgency: high
Maintainer: Dovecot Maintainers <jaldhar-dovecot@debian.org>
Changed-By: Fabio Tranchitella <kobold@debian.org>
Description: 
 dovecot-common - secure mail server that supports mbox and maildir mailboxes
 dovecot-dev - header files for the dovecot mail server
 dovecot-imapd - secure IMAP server that supports mbox and maildir mailboxes
 dovecot-pop3d - secure POP3 server that supports mbox and maildir mailboxes
Closes: 469457
Changes: 
 dovecot (1:1.0.12-1) unstable; urgency=high
 .
   * New upstream release. (Closes: #469457)
   * debian/patches/dovecot-MANAGESIEVE-9.2.dpatch: updated, thanks to Marco
     Nenciarini for the patch.
Files: 
 dd204cd4c2b78ad919bf4d372a434d69 1183 mail optional dovecot_1.0.12-1.dsc
 a03779d3df13eadd0d3fa42802143e1e 1772998 mail optional dovecot_1.0.12.orig.tar.gz
 be1878be5ad16a86208fd036dea772ab 217616 mail optional dovecot_1.0.12-1.diff.gz
 5214cacab83cfc270f6bc3cae1290289 2067270 mail optional dovecot-common_1.0.12-1_amd64.deb
 c713729bf56848b0fffa2c28213e91d4 386644 mail optional dovecot-dev_1.0.12-1_amd64.deb
 8a79346eb304eeea26f23cfabd7d2acd 659088 mail optional dovecot-imapd_1.0.12-1_amd64.deb
 73a4171b26df436107ae5691d93f1192 622006 mail optional dovecot-pop3d_1.0.12-1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFH0BKEK/juK3+WFWQRAmkmAJ0YEpRyZQpuZbGvnyxPuwBzWt5YzACdGxZk
Mu2uDAILAk/bOOmib155qCo=
=EyWR
-----END PGP SIGNATURE-----





Information forwarded to debian-bugs-dist@lists.debian.org, Dovecot Maintainers <jaldhar-dovecot@debian.org>:
Bug#469457; Package dovecot-imapd. Full text and rfc822 format available.

Acknowledgement sent to Jeremie Bouttier <bouttier@spht.saclay.cea.fr>:
Extra info received and forwarded to list. Copy sent to Dovecot Maintainers <jaldhar-dovecot@debian.org>. Full text and rfc822 format available.

Message #24 received at 469457@bugs.debian.org (full text, mbox):

From: Jeremie Bouttier <bouttier@spht.saclay.cea.fr>
To: 469457@bugs.debian.org
Subject: Re: Bug#469457 closed by Fabio Tranchitella <kobold@debian.org> (Bug#469457: fixed in dovecot 1:1.0.12-1)
Date: Mon, 10 Mar 2008 09:40:34 +0100
This addresses the issue for Lenny & Sid, but how about the version in 
Etch ?




Information forwarded to debian-bugs-dist@lists.debian.org, Dovecot Maintainers <jaldhar-dovecot@debian.org>:
Bug#469457; Package dovecot-imapd. Full text and rfc822 format available.

Acknowledgement sent to Fabio Tranchitella <kobold@kobold.it>:
Extra info received and forwarded to list. Copy sent to Dovecot Maintainers <jaldhar-dovecot@debian.org>. Full text and rfc822 format available.

Message #29 received at 469457@bugs.debian.org (full text, mbox):

From: Fabio Tranchitella <kobold@kobold.it>
To: Jeremie Bouttier <bouttier@spht.saclay.cea.fr>, 469457@bugs.debian.org
Subject: Re: Bug#469457: closed by Fabio Tranchitella <kobold@debian.org> (Bug#469457: fixed in dovecot 1:1.0.12-1)
Date: Mon, 10 Mar 2008 10:00:54 +0100
Hello,

* 2008-03-10 09:45, Jeremie Bouttier wrote:
> This addresses the issue for Lenny & Sid, but how about the version in
> Etch ?

I'm working on it...

-- 
Fabio Tranchitella                         http://www.kobold.it
Free Software Developer and Consultant     http://www.tranchitella.it
_____________________________________________________________________
1024D/7F961564, fpr 5465 6E69 E559 6466 BF3D 9F01 2BF8 EE2B 7F96 1564




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 08 Apr 2008 07:38:31 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Apr 19 20:20:33 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.