http://dovecot.org/releases/1.0/dovecot-1.0.13.tar.gzhttp://dovecot.org/releases/1.0/dovecot-1.0.13.tar.gz.sighttp://dovecot.org/releases/1.1/rc/dovecot-1.1.rc3.tar.gzhttp://dovecot.org/releases/1.1/rc/dovecot-1.1.rc3.tar.gz.sig
Note that the changes for the security hole fix were quite large. I
tested with several auth configurations myself and they seemed to work,
but it's possible I left a bug somewhere in there breaking someone's
configuration. So make sure to test that it works after upgrading.
Of course it would be really nice if Dovecot had a proper test suite
where testing all configurations could be automated and run before each
release. I've already started this with my imaptest tool
(http://imapwiki.org/ImapTest), but it only does IMAP tests and a lot of
things are still missing. Some help would be nice here.
* Fixed a security hole in blocking passdbs (MySQL always. PAM, passwd
and shadow if blocking=yes) where user could specify extra fields
in the password. The main problem here is when specifying
"skip_password_check" introduced in v1.0.11 for fixing master user
logins, allowing the user to log in as anyone without a valid
password.
- mail_privileged_group was broken in some systems (OS X, Solaris?)
- IMAP THREAD: Fixed some correctness problems
This affects only blocking passdbs:
- MySQL
- PAM, passwd and shadow if blocking=yes
The underlying bug exists in all v1.0.x versions, but I couldn't figure
out a way to exploit it except with v1.0.11, v1.0.12 and v1.1.rc2.
Probably a good idea to upgrade in any case.
The main problem is that Dovecot's internal protocols use TAB character
as a delimiter, but passwords were sent unescaped through them. So
passwords containing TAB characters allowed to add new internal fields.
The main problem here is a new "skip_password_check" field added in
v1.0.11 to fix problems with master user logins. Specifying this field
allowed the user to skip the password check, as the name implies.
This has been fixed thoroughly in v1.0.13 and v1.1.rc3 to make sure
there are no more escaping problems with any fields, but it can be also
fixed with a less intrusive patch for v1.0:
http://hg.dovecot.org/dovecot-1.0/raw-rev/da2a9372e26e
http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc2.tar.gzhttp://dovecot.org/releases/1.1/rc/dovecot-1.1.rc2.tar.gz.sig
Changes since rc1:
* mail_extra_groups setting was commonly used insecurely. This setting
is now deprecated. Most users should switch to using
mail_privileged_group setting, but if you really need the old
functionality use mail_access_groups instead.
+ Expire plugin now supports wildcards in mailbox names.
+ dbox: Expire plugin supports moving old mails to alternative
dbox directory
+ Maildir++ quota: quota_rule=?:<rule> specifies a default rule
which is used only if the maildirsize file doesn't exist.
+ If SSL/TLS connection isn't closed cleanly, log the last error
in the disconnection line.
+ EXPUNGE: If new \Deleted messages were found while expunging,
do it again and expunge them as well (Outlook workaround)
- IMAP: SEARCH, LIST and THREAD command correctness fixes
- Maildir++ quota: Quota rules and warnings with % rules didn't work
if the default limits were taken from maildirsize file.
- Maildir++ quota: If both byte and message limits weren't specified,
maildirsize file was recalculated all the time
- mbox: Flag and keyword updates may have gotten lost in some
situations (happens with v1.0 too)
- ldap: Don't crash if userdb lookup fails
- Squat fixes and performance improvements
Things left to do for v1.1.0:
- dbox has a metadata corruption bug, find and fix it
- Squat has some locking issues that causes errors when stress testing
with multiple connections
- Squat doesn't do NFS cache flushing and has some other NFS problems.
http://dovecot.org/releases/1.0/dovecot-1.0.11.tar.gzhttp://dovecot.org/releases/1.0/dovecot-1.0.11.tar.gz.sig
* mail_extra_groups setting was commonly used insecurely. This setting
is now deprecated. Most users should switch to using
mail_privileged_group setting, but if you really need the old
functionality use mail_access_groups instead.
- mbox: Dropped some of the physical size fetch optimizations added
in v1.0.8. This makes some commands slower, but should fix the rest
of the problems.
- IMAP: SEARCH BEFORE/ON/SINCE didn't handle timezones correctly.
- ldap: auth_bind was doing lookups using subtree scope instead of
the scope specified in config file.
- zlib plugin crashfixes by Richard Platel
- master passdbs: pass=yes setting was broken with blocking passdbs
(e.g. MySQL)
mail_extra_groups=mail setting is often used insecurely to give Dovecot
access to create dotlocks to /var/mail directory. If you don't use
mboxes in /var/mail, make sure this setting is cleared.
If you do use /var/mail mboxes and Dovecot gives permission errors
without it, do one of the following (in the preferred order):
a) Upgrade to v1.0.11 and use the new mail_privileged_group setting
instead of mail_extra_groups.
b) Make /var/mail sticky and world-writable (chmod 01777 /var/mail) and
clear mail_extra_groups setting.
c) Make /var/mail sticky (chmod +t /var/mail) and keep mail_extra_groups
setting. This fixes the main problem but some may be left.
The mail_privileged_group setting is also available as a patch:
http://dovecot.org/patches/1.0/dovecot-1.0.10.mail_priv_groups.diff
mail_extra_groups setting has existed since Dovecot v0.99.10.6. It's
never been enabled by default in the distributed dovecot-example.conf,
but some distributions enable it by default (at least Debian).
A longer explanation:
The main problem is that if users have filesystem access to the mail
server, they can create symlinks. Dovecot doesn't try to prevent
following symlinks (and I don't think it should) and normally it isn't a
problem. But when mail_extra_groups=mail is set:
1a) Maildir: Any files readable by mail group can be read by the user by
symlinking the file to their ~/Maildir/cur/.
1b) Any mbox files readable by mail group can be read by the user by
symlinking the mbox file to their ~/mail/ directory.
These are pretty obvious problems and I didn't think they were all that
important. Why would anyone have secret files that are mail
group-readable? But apparently those do exist in some systems (maybe
accidentally).
2a) mbox: Any files/directories under mail group-writable directories
can be created/deleted/renamed by symlinking the directory under
~/mail/. For example ln -s /var/mail ~/mail/var, DELETE var/root will
happily delete root's mailbox. This I hadn't thought about before.
2b) Maildir: Pretty much the same thing can be done with maildir but
with a little less control.
mail_privileged_group setting works by keeping the group in process's
saved GID while it's not in use and temporarily switching it to
effective GID while dotlocks are created. Currently this is done only
when:
1. It's only done for INBOX mbox which doesn't exist under the same
location as other mailboxes (so typically under /var/mail).
2. It's used only after initial dotlock creation try failed with EACCES
error.