- Dovecot-news - dovecot.org

Security holes in CMU Sieve plugin
by Timo Sirainen 14 Sep '09

14 Sep '09

A recently found security hole in Cyrus Sieve exists also in Dovecot, because Dovecot's Sieve plugin is based on libsieve from Cyrus project. I also found and fixed a few additional buffer overflows that I can't really understand why I hadn't noticed/fixed before. This security hole affects all installations that give their users any kind of ability to modify their Sieve scripts. Even if you give only limited access it might be enough for an attacker. For example forwarding a user's mails to about 100 addresses should do the trick. Since these are buffer overflows for variables in stack, they're very likely exploitable and allow attackers to execute arbitrary code as the user. Note that this security hole doesn't exist in Stephan Bosch's excellent new Sieve plugin for Dovecot v1.2. I encourage everyone to switch to using it as soon as possible. Who knows what other holes still lurk in libsieve. The bugs are fixed in v1.1.7 release for Dovecot v1.1+: http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz.sig and in v1.0.4 release for Dovecot v1.0: http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz.sig You can also get them as a patch: http://hg.dovecot.org/dovecot-sieve-1.1/rev/049f22520628 http://hg.dovecot.org/dovecot-sieve-1.1/rev/4577c4e1130d

1 0

Released Sieve v0.1.12 and ManageSieve v0.11.9 for Dovecot v1.2.4
by Stephan Bosch 21 Aug '09

21 Aug '09

Hello Dovecot users, I finally managed to make new releases of Sieve and ManageSieve for the recent Dovecot v1.2.4 release. The ManageSieve release is important to match login proxy API changes in Dovecot; older versions will not compile against the new Dovecot release. The new Sieve release first includes the new date extension, which allows matching against date values in header fields and the current date-time at script execution. Changelog Sieve v0.1.12: + Testsuite: added support for testing binaries stored on disk. + Implemented the new date extension. This allows matching against date values in header fields and the current date at the time of script evaluation. Changelog ManageSieve v0.11.9: * Adjusted to changes in the Dovecot login proxy API. This release therefore depends on Dovecot v1.2.4. + Reintroduced ability to abort SASL with "*" response. Latest ManageSieve specification includes it. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.12.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.12.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.9.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.9.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.4-managesieve-0.11.9.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.4-managesieve-0.11.9.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.2.4 released
by Timo Sirainen 17 Aug '09

17 Aug '09

http://dovecot.org/releases/1.2/dovecot-1.2.4.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.4.tar.gz.sig I'll be on vacation for the rest of this week. I'll read my mails once in a while though. * acl: When looking up ACL defaults, use global/local default files if they exist. So it's now possible to set default ACLs by creating dovecot-acl file to the mail root directory. + imap/pop3 proxy: If proxy destination is known to be down, fail connections to it immediately. + imap/pop3 proxy: Added proxy_timeout passdb extra field to specify proxy's connect timeout. - Fixed a crash in index file handling. - Fixed a crash in saving messages where message contained a CR character that wasn't followed by LF (and the CR happened to be the last character in an internal buffer). - v1.2.3 crashed when listing shared namespace prefix. - listescape plugin: Several fixes. - autocreate plugin: Fixed autosubscribing to mailboxes in subscriptions=no namespaces.

1 0

Released Sieve v0.1.11 and ManageSieve v0.11.8 for Dovecot v1.2.3
by Stephan Bosch 08 Aug '09

08 Aug '09

Hello Dovecot users, Apart from unfinished development of the date extension, this is a set of bug-fix releases. A few portability issues were found, a few stupidities were fixed and the ManageSieve proxy now also works with TLS. Most notably, the include extension had an issue regarding the expansion of $HOME in the personal include path. I've built a project site at: http://pigeonhole.dovecot.org Changelog Sieve v0.1.11: + Built skeleton implementation for the date extension (RFC5260). It compiles, but it does not do anything useful yet. Therefore, it is not part of the default compilation. - Fixed ARM portability issues caused by char type not being signed on that platform. Reading optional operands from a binary would fail for action side effects. Also, an accidental mixup of an int return type with bool caused the interpreter to continue on ARM even though an error occured. - Removed direct stdint.h includes to prevent portability issues. - Fixed segfault bug in the handling of script open failures. - Include: improved user error messages and system log messages. - Fixed copy-paste mixup between sieve_after and sieve_before settings in the LDA Sieve plugin. If only a sieve_after script was active, nothing would have been executed. Patch by Mike Abbott. - Include: fixed a bug in HOME substitution in the sieve_dir path. Surfaced in ManageSieve. Changelog ManageSieve v0.11.8: - Fixed TLS support for proxying ManageSieve. The protocol state machine was incorrect. Also added a check that disables ssl when 'starttls' is not enabled for the user. This produces a proper warning in the log file. There is no such thing as a managesieveS protocol which has SSL from the start. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.11.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.11.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.8.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.8.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.3-managesieve-0.11.8.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.3-managesieve-0.11.8.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.2.3 released
by Timo Sirainen 08 Aug '09

08 Aug '09

http://dovecot.org/releases/1.2/dovecot-1.2.3.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.3.tar.gz.sig A few days later than I wanted, but here it is. * Mailbox names with control characters can't be created anymore. Existing mailboxes can still be accessed though. + Allow namespace prefix to be opened as mailbox, if a mailbox already exists in the root dir. - Maildir: dovecot-uidlist was being recreated every time a mailbox was accessed, even if nothing changed. - listescape plugin was somewhat broken - Compiling fixes for non-Linux/BSDs - imap: tb-extra-mailbox-sep workaround was broken. - ldap: Fixed hang when >128 requests were sent at once. - fts_squat: Fixed crashing when searching virtual mailbox. - imap: Fixed THREAD .. INTHREAD crashing.

1 0

Released Sieve v0.1.10 for Dovecot v1.2.2
by Stephan Bosch 03 Aug '09

03 Aug '09

Hello Dovecot users, In the last week two nasty bugs were found in the new Sieve implementation. Primarily, the include extension did not work when a compiled binary was loaded from disk. This is something that is still not tested by the test suite, giving this bug the opportunity to slip through. Also, the value matching implementation would sometimes cause a assertion failure. Other than that, various small bugs were fixed. On the more positive side, I have implemented support for the new mailbox extension (RFC 5490), which provides the means to test whether a mailbox exists. Also, it adds the :create argument to the fileinto command, which makes sure that the target folder is created before saving is attempted. Of course, this is only useful when deliver is used with the -n option. There wasn't a great need for this extension, but I could use it in the test suite and it was almost trivial to implement. In other news, I have further developed the sieve-filter command line tool. It is getting closer to a usable state, being able to filter a large number of messages in an existing mailbox, but its use is currently still very much discouraged as it tends to be very good at eating mailboxes when the user is less attentive. It needs more command line configuration options, a simulation mode to perform a dry run, and a man page that describes its use and its dangers. Changelog for Sieve v0.1.10: * Changed action execution of fileinto and keep. These changes depend on API additions in Dovecot, making this release depend on Dovecot v1.2.2 or newer. * Further developed the sieve-filter command line tool. This required a few changes to the action execution of the Sieve engine. The tool was successfully tested on folders with a few 100k spam messages. However, the commandline options are still incomplete, a man page is missing and it needs much more testing before I can recommend anyone to use this tool. + Added support for the mailbox extension. This allows checking whether a mailbox exists using the mailboxexists command and it adds the :create argument to the fileinto command to create the mailbox when it is missing. The :create feature is useless unless the Deliver LDA is run with the -n option. + Improved the testsuite with tests for message delivery. Messages stored using keep and fileinto can be fed back into the Sieve engine for verification. This includes testing of applied IMAP flags. + Updated the man pages with the new method of specifying the supported extensions using + and - (for the -x parameter of the sieve tools) + Further developed the deprecated notify extension. A dummy for the denotify command exists, meaning that its use does not cause an error anymore. - Fixed a bug in the derivation of the binary path from the script path. A bare filename would yield a path relative to root. - Fixed a bug in the value matching code. The context data now uses a proper pool in stead of the data stack. Bug reported by Jan Sechser. - Fixed assertion fail in the include extension caused by missing initialization upon binary load. This bug surfaces only for stored binaries. Bug reported by Tom Hendrikx. - Fixed include error message for failed :global include. It mentioned the wrong config parameter. - Fixed broken wiki reference in an error message of the plugin about the 'sieve' setting. - Fixed behavior of fileinto when delivering into a namespace prefix. Previous fix used the wrong storage. The release is available as follows: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.10.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.10.tar.gz.sig Have fun testing the new releases and don't hesitate to notify me when there are problems. Please include your configuration, the involved Sieve scripts and an example message in any bug or problem report when possible, so that I can easily reproduce the issue. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.1.18 released
by Timo Sirainen 27 Jul '09

27 Jul '09

http://dovecot.org/releases/1.1/dovecot-1.1.18.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.18.tar.gz.sig A few more fixes to v1.1 series. It probably won't have many released left. + dovecot -n/-a now outputs also lda settings. - Maildir++ quota: Quota was sometimes updated wrong when it was being recalculated. - Searching quoted-printable message body internally converted "_" characters to spaces and didn't match search keys with "_". - Messages in year's first/last day may have had broken timezones with OSes not having struct tm->tm_gmtoff (e.g. Solaris).

2 1

v1.2.2 released
by Timo Sirainen 27 Jul '09

27 Jul '09

http://dovecot.org/releases/1.2/dovecot-1.2.2.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.2.tar.gz.sig Found and fixes several v1.2-specific bugs. Hopefully it's now stable for most people's usage. * GSSAPI: More changes to authentication. Hopefully good now. * lazy_expunge plugin: Drop \Deleted flag when moving message. + dovecot -n/-a now outputs also lda settings. + dovecot.conf !include now supports globs (e.g. !include /etc/dovecot/*.conf). Based on patch by Thomas Guthmann. + acl: Support spaces in user/group identifiers. + shared mailboxes: If only %%n is specified in prefix, default to current user's domain. - Dovecot master process could hang if it received signals too rapidly. - Fixed "corrupted index cache file" errors (and perhaps others) caused by e.g. IMAP's FETCH BODY[] command. - IMAP: When QRESYNC is enabled, don't crash when a new mail is received while IDLEing. - IMAP: FETCH X-* parameters weren't working. - Maildir++ quota: Quota was sometimes updated wrong when it was being recalculated. - Searching quoted-printable message body internally converted "_" characters to spaces and didn't match search keys with "_". - Messages in year's first/last day may have had broken timezones with OSes not having struct tm->tm_gmtoff (e.g. Solaris). - virtual plugin: If another session adds a new mailbox to index, don't crash.

2 1

Released Sieve v0.1.9 for Dovecot v1.2.1
by Stephan Bosch 23 Jul '09

23 Jul '09

Hello Dovecot users, Relatively many bugs and problems were reported recently in a short period of time. Apparently, now that Dovecot v1.2 is finally stable, the new Sieve plugin is also starting to get used much more. No known bugs remain. Let's hope I didn't spawn any new ones. Apart from the bugfixes I made the deprecated notify plugin implementation compatible with CMUSieve. You can use it, but keep in mind that the (rather stupid) denotify command is not (yet) implemented and that the $text$ substitution does not work (yes, there is a world of differences compared to enotify). Changelog Sieve v0.1.9: * Removed the unfinished sieve-filter tool from the default build. It is now only built when the --with-unfinished-features switch is supplied during configure. + Started building support for the ereject version of the reject action, which has a preference to use an SMTP/LMTP protocol error in stead of a bounce message. This is to be used to make the Sieve plugin honour Deliver's -e parameter. This is not yet finished and not built by default. + Improved 'Permission denied' error messages just like Dovecot does, precisely specifying what permission is missing to access or create a file. + Added additional headers to the list of allowed headers for the address test. The restrictive nature of the address test is not always appropriate. Still thinking of a better, less restrictive implementation. + Made the deprecated notify extension compatible with the old CMUSieve plugin. However, the denotify command and the $text$ substitution are not yet supported. + Made the discard action log a message to avoid confusion about disappearing messages. - Fixed behavior of fileinto when delivering into a namespace prefix. It now uses silent delivery into INBOX as fallback. - Fixed logging of folder namespace prefix upon delivery into a prefixed namespace. Formerly it only logged the bare folder name. - Fixed a potential segfault in the argument validation. It didn't surface because no command could have a :tag followed by an associated parameter as last argument. - Fixed segfault bug occuring in envelope test when performed on null (<>) envelope path. The fix involves a rather large restructuring of the code to make sure envelope addresses are properly handled everywhere (bug reported by Nikita Koshikov) - Envelope: fixed bug in application of address parts; failure to obtain the part would cause inappropriate match success (bug reported by Ron Lee) - Fixed extension conflict checks during validation. It could sometimes produce useless errormessages. This is currently only used by the deprecated extensions. - Forgot to remove old explicit storage library dependency (patch by Arkadiusz Miskiewicz). - Fixed compiler warnings on certain platforms regarding the use fwrite for outgoing message construction -- The releases are available as follows: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.9.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.9.tar.gz.sig -- Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Released ManageSieve v0.10.7 for Dovecot v1.1.17
by Stephan Bosch 13 Jul '09

13 Jul '09

Hello Dovecot users, This release is entirely composed of bug fixes, most of which were found and fixed earlier in the implementation for Dovecot v1.2. Changelog ManageSieve v0.10.7: - Fixed generation of core dumps. - Fixed panic occurring when many errors are produced by the Sieve compiler (bug found by Pascal Volk). - Fixed potential memory leak in the PUTSCRIPT command. - Fixed CRLF line breaks in compile errors. - Improved handling of script truncation bugs: connection is now closed. (ManageSieve patch) - Forgot to add the managesieve_logout_format setting to the config file. Now it works (bug reported by Pascal Volk). -- The releases are available as follows: http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.7.tar.gz http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.7.tar.gz.s… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1.17-managesieve-0.10.7.diff.… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1.17-managesieve-0.10.7.diff.… -- Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0