[Dovecot-news] Security hole #6: Some passdbs allowed users to log in without a valid password

[Timo Sirainen]

This affects only blocking passdbs:

 - MySQL
 - PAM, passwd and shadow if blocking=yes

The underlying bug exists in all v1.0.x versions, but I couldn't figure
out a way to exploit it except with v1.0.11, v1.0.12 and v1.1.rc2.
Probably a good idea to upgrade in any case.

The main problem is that Dovecot's internal protocols use TAB character
as a delimiter, but passwords were sent unescaped through them. So
passwords containing TAB characters allowed to add new internal fields.
The main problem here is a new "skip_password_check" field added in
v1.0.11 to fix problems with master user logins. Specifying this field
allowed the user to skip the password check, as the name implies.

This has been fixed thoroughly in v1.0.13 and v1.1.rc3 to make sure
there are no more escaping problems with any fields, but it can be also
fixed with a less intrusive patch for v1.0:
http://hg.dovecot.org/dovecot-1.0/raw-rev/da2a9372e26e

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://dovecot.org/pipermail/dovecot-news/attachments/20080309/c36aca32/attachment.bin