[Dovecot] Security Hole in 1.0.13?

[Lawrence Sheed]

Typically before I kill a system thats been compromised, I try to find  
out the reason, so it DOESNT happen again.

In this instance I have 2 systems with exactly the same "issue"

Both were running smoothly until about last week, then load spikes  
were observed.

In both systems, the the attacker has changed the dovecot.conf to  
point at dotvecot
I'm guessing around the 13th as thats when the /var/run/dovecot folder  
was updated.

I'll do the rest offlist.

Andraz, thank you.
Washington, you're an asshole.

Cheers,

Lawrence.


On May 18, 2008, at 3:03 PM, Lawrence Sheed wrote:

> Corrected that in the conf file.
>
> If I check the dovecot user, I see its been compromised also - a  
> bunch of crap in their login folder.
> I didn't create the dovecot.conf with a /var/run/dotvecot though, so  
> someone else did that.
>
> More updates as I check further.
>
> On May 18, 2008, at 2:54 PM, Andraž 'ruskie' Levstik wrote:
>
>> ROFL...
>>
>> This was a good way to start the day...
>>
>> Correct your typo in the dovecot.conf file ;)
>>
>> Here's a hint ;) See base_dir...
>>
>>>
>>> drwxr-xr-x  3 root        root        4096 2008-05-18 13:30 dotvecot
>>>
>>> dovecot.conf
>>>
>>> cat /etc/dovecot/dovecot.conf
>>> base_dir = /var/run/dotvecot
>>
>>
>> --
>> Andraž "ruskie" Levstik
>> Source Mage GNU/Linux Games grimoire guru
>> Geek/Hacker/Tinker
>>
>> Be sure brain is in gear before engaging mouth.
>> Ryle hira.
>>
>> Key id = F4C1F89C
>> Key fingerprint = 6FF2 8F20 4C9D DB36 B5B6  F134 884D 72CC F4C1 F89C
>>
>>
>
>