September 2009 - Dovecot-news

v1.2.5 released
by Timo Sirainen 14 Sep '09

14 Sep '09

http://dovecot.org/releases/1.2/dovecot-1.2.5.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.5.tar.gz.sig I'll be more or less gone for next two weeks. Tomorrow I'm heading to MacSysAdmin in Sweden to give a Dovecot talk, the next week I'll be in Finland on vacation. After that I'm hoping to get v2.0.alpha1 released in October. * Authentication: DIGEST-MD5 and RPA mechanisms no longer require user's login realm to be listed in auth_realms. It only made configuration more difficult without really providing extra security. * zlib plugin: Don't allow clients to save compressed data directly. This prevents users from exploiting (most of the) potential security holes in zlib/bzlib. + Added pop3_save_uidl setting. + dict quota: When updating quota and user isn't already in dict, recalculate and save the quota. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors. - v1.2.4 index file handling could have caused an assert-crash - IMAP: Fixes to QRESYNC extension. - virtual plugin: Crashfix - deliver: Don't send rejects to any messages that have Auto-Submitted header. This avoids emails loops. - Maildir: Performance fixes, especially with maildir_very_dirty_syncs. - Maildir++ quota: Limits weren't read early enough from maildirsize file (when quota limits not enforced by Dovecot) - Message decoding fixes (mainly for IMAP SEARCH, Sieve).

1 0

v1.1.19 released
by Timo Sirainen 14 Sep '09

14 Sep '09

http://dovecot.org/releases/1.1/dovecot-1.1.19.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.19.tar.gz.sig This is hopefully the last v1.1.x release. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors. - ldap: Fixed hang when >128 requests were sent at once. - Fixed a crash in saving messages where message contained a CR character that wasn't followed by LF (and the CR happened to be the last character in an internal buffer). - deliver: Don't send rejects to any messages that have Auto-Submitted header. This avoids emails loops. - Message decoding fixes (mainly for IMAP SEARCH, Sieve).

1 0

Security holes in CMU Sieve plugin
by Timo Sirainen 14 Sep '09

14 Sep '09

A recently found security hole in Cyrus Sieve exists also in Dovecot, because Dovecot's Sieve plugin is based on libsieve from Cyrus project. I also found and fixed a few additional buffer overflows that I can't really understand why I hadn't noticed/fixed before. This security hole affects all installations that give their users any kind of ability to modify their Sieve scripts. Even if you give only limited access it might be enough for an attacker. For example forwarding a user's mails to about 100 addresses should do the trick. Since these are buffer overflows for variables in stack, they're very likely exploitable and allow attackers to execute arbitrary code as the user. Note that this security hole doesn't exist in Stephan Bosch's excellent new Sieve plugin for Dovecot v1.2. I encourage everyone to switch to using it as soon as possible. Who knows what other holes still lurk in libsieve. The bugs are fixed in v1.1.7 release for Dovecot v1.1+: http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz.sig and in v1.0.4 release for Dovecot v1.0: http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz.sig You can also get them as a patch: http://hg.dovecot.org/dovecot-sieve-1.1/rev/049f22520628 http://hg.dovecot.org/dovecot-sieve-1.1/rev/4577c4e1130d

1 0