- Dovecot-news - dovecot.org

Security hole #4: Specific LDAP + auth cache configuration may mix up user logins
by Timo Sirainen 21 Dec '07

21 Dec '07

Somehow I doubt there are any Dovecot setups left that unknowingly have this problem, but it still counts as a security hole. The possibility to cause this problem exists in Dovecot v1.0.rc11 and later. If you use: 1. passdb ldap with settings: - auth_bind = yes - auth_bind_userdn = no - base containing %variables required for unique user identification, e.g. base = dc=%d,dc=org - pass_filter not containing all %variables required for unique user identification - pass_attrs returning user-specific settings, such as user's home directory 2. userdb prefetch 3. auth_cache_size non-zero (0 is default) If two users with the same password and same pass_filter variables log in within auth_cache_ttl seconds (1h by default), the second user may get logged in with the first user's cached pass_attrs. For example if pass_attrs contained the user's home/mail directory, this would mean that the second user will be accessing the first user's mails. You most likely would have noticed this already by wondering why logins keep failing, unless pass_filter used also some %variables that most of the time uniquely identifies the user. For example %r (remote IP address) or %n (username without domain). You can fix this by upgrading to v1.0.10 (to be released soon), or using this patch: http://hg.dovecot.org/dovecot-1.0/raw-rev/2cedab21cd6d

1 0

v1.0.9 released
by Timo Sirainen 11 Dec '07

11 Dec '07

http://dovecot.org/releases/1.0/dovecot-1.0.9.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.9.tar.gz.sig + Maildir: Don't wait on dovecot-uidlist.lock when we just want to find out a new filename for the message. - mbox: v1.0.8 changes sometimes caused FETCH to fail with "got too little data", disconnecting the client. - Fixed a memory leak when FETCHing message header/body multiple times within a command (e.g. BODY[1] BODY[2]) - IMAP: Partial body fetching was still slow with mboxes

1 0

v1.0.8 released
by Timo Sirainen 28 Nov '07

28 Nov '07

http://dovecot.org/releases/1.0/dovecot-1.0.8.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.8.tar.gz.sig + Authentication: Added "password_noscheme" field that can be used instead of "password". "password" treats "{prefix}" as a password scheme while "password_noscheme" treats it as part of the password itself. So "password_noscheme" should be used if you're storing passwords as plaintext. Non-plaintext passwords never begin with "{", so this isn't a problem with them. - IMAP: Partial body fetching was sometimes non-optimal, causing the entire message to be read for every FETCH command. - deliver failed to save the message when envelope sender address contained spaces. - Maildir++ quota: We could have randomly recalculated quota when it wasn't necessary. - Login process could have crashed after logging in if client sent data before "OK Logged in" reply was sent (i.e. before master had replied that login succeeded). - Don't assert-crash when reading dovecot.index.logs generated by Dovecot v1.1. - Authentication: Don't assert-crash if password beings with "{" but doesn't contain "}". - Authentication cache didn't work when using settings that changed the username (e.g. auth_username_format).

1 0

v1.0.7 released
by Timo Sirainen 29 Oct '07

29 Oct '07

http://dovecot.org/releases/1.0/dovecot-1.0.7.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.7.tar.gz.sig Almost missed this one. I had already fixed it in v1.1 tree, but forgot to fix in v1.0 tree. - deliver: v1.0.6's "From " line ignoring could have written to a bad location in stack, possibly causing problems.

1 0

v1.0.6 released
by Timo Sirainen 28 Oct '07

28 Oct '07

http://dovecot.org/releases/1.0/dovecot-1.0.6.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.6.tar.gz.sig * IDLE: Interval between mailbox change notifies is now 1 second, because some clients keep a long-running IDLE connection and use other connections to actually read the mails. * SORT: If Date: header is missing or broken, fallback to using INTERNALDATE (as the SORT draft nowadays specifies). + deliver: If message begins with a "From " line, ignore it. + zlib plugin: If maildir file has a "Z" flag, open it with zlib. - CREATE: Don't assert-crash if trying to create namespace prefix. - SEARCH: Fixes to handling NOT operator with sequence ranges. - LDAP reconnection fixes - Maildir: Don't break when renaming mailboxes with '*' or '%' characters and children. - mbox: Fixed "file size unexpectedly shrinked" error in some conditions. - quota+mbox: Don't fail if trying to delete a directory. - Fixes to running from inetd

1 0

v1.1.beta1 released
by Timo Sirainen 23 Sep '07

23 Sep '07

http://dovecot.org/releases/1.1/beta/dovecot-1.1.beta1.tar.gz http://dovecot.org/releases/1.1/beta/dovecot-1.1.beta1.tar.gz.sig Alpha6 seemed to finally work quite well, so I think it's time for a feature freeze (except for dbox changes). I started a new wiki page to list incompatibilities between v1.0 and v1.1: http://wiki.dovecot.org/Upgrading/1.1 Fixes since alpha6: - deliver + maildir caused "UID 0 in transaction log" errors - deliver + maildir no longer blocks if dovecot-uidlist.lock file exists. The mail is simply delivered without updating uidlist or indexes. - Quota handling fixes, especially dict quota - etc.

1 0

v1.0.5 released
by Timo Sirainen 09 Sep '07

09 Sep '07

http://dovecot.org/releases/1.0/dovecot-1.0.5.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.5.tar.gz.sig v1.0.4 was a bit bad release. - deliver: v1.0.4 broke home directory handling - maildir: Creating mailboxes didn't use dovecot-shared's group for cur/new/tmp directories.

1 0

v1.0.4 released
by Timo Sirainen 08 Sep '07

08 Sep '07

http://dovecot.org/releases/1.0/dovecot-1.0.4.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.4.tar.gz.sig * Assume a MIME message if Content-Type: header exists, even if Mime-Version: header doesn't. - IMAP: CREATE ns_prefix/box/ didn't work right when namespace prefix existed. - deliver: plugin {} settings were overriding settings from userdb. - mbox: Expunging the first message might not have worked always - PostgreSQL: If we can't connect to server, timeout queries after a while instead of trying forever. - Solaris: sendfile() support was broken and could have caused 100% CPU usage and the connection hanging. And one more thing I forgot from NEWS file: - IMAP: Fixed infinite loop in some situations

1 0

v1.0.3 released
by Timo Sirainen 01 Aug '07

01 Aug '07

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz.sig - deliver: v1.0.2's bounce fix caused message to be always saved to INBOX even if Sieve script had discard, reject or redirect commands. - LDAP: auth_bind=yes and empty auth_bind_userdn leaked memory - ACL plugin: If user was given i (insert) right for a mailbox, but not all s/t/w (seen, deleted, other flags) rights, COPY and APPEND commands weren't supposed to allow saving those flags. This is technically a security fix, but it's unlikely this caused problems for anyone. - ACL plugin: i (insert) right didn't work unless user was also given l (lookup) right. - Solaris: Fixed filesystem quota for autofs mounts.

1 0

v1.1.alpha1 released
by Timo Sirainen 19 Jul '07

19 Jul '07

http://dovecot.org/releases/1.1/alpha/dovecot-1.1.alpha1.tar.gz http://dovecot.org/releases/1.1/alpha/dovecot-1.1.alpha1.tar.gz.sig This is the first alpha release of Dovecot v1.1. I hope that it stabilizes into final release within a few months. There are a lot of new features since v1.0. The most important ones are listed at the end of this post. This is the only v1.1.alpha announcement I send to dovecot-news list (or to www.dovecot.org news). The next one probably will be v1.1.rc1. I've been stress testing the code a lot and I've also been using it myself for almost a year, so I think this release should actually be quite stable and usable. But since I haven't tested everything, there might be some crashes and misbehaving commands. So this release should now have all the major features that I intend to add to v1.1 (except for dbox rewrite, see below). Some smaller features will still be added. The rest of the major features in my previous v1.1 list will go to v1.2. While v1.1 is getting stabilized I'm beginning to rewrite dbox code. Its code is isolated from the rest of Dovecot, so it can't destabilize anything else. Hopefully it will be ready before v1.1 release, although maybe still marked as experimental. Some of the features might not be considered quite ready yet: - Mailbox list indexes improve STATUS performance a lot (maybe 7x) when mailboxes haven't changed. Handling updates however is a lot slower than I'd want (2x with one client, more with multiple), so you may want to disable them with mailbox_list_index_disable=yes until the update performance gets better. - THREAD code is completely rewritten with support for incremental updates and index files. I tested it last year and it seemed OK, but I didn't dare try it now so I wouldn't have to delay this alpha if it was broken :) I'll do some more testing soon, but for now be careful with using v1.1 with webmails. - SORT code also uses indexes now, but it's a lot simpler so it probably works. - Squat indexes work and I'm using them myself, but they'll be rewritten for v1.2 with a new faster format. - Although Dovecot now flushes NFS attribute/data caches when needed, I'm not sure if it's done in all the necessary places. - I don't remember if I've tested expire plugin at all. So, the largest changes I've added to NEWS file (which BTW won't contain changes between alphas/betas/rcs, those will be only in my mailing list posts): * After Dovecot v1.1 has modified index or dovecot-uidlist files, they can't be opened anymore with Dovecot versions earlier than v1.0.2. * Empty passwords in passdb doesn't allow user to log in with any password anymore. To do that you'll also need to set nopassword extra field. + IMAP: Added support for UIDPLUS and LIST-EXTENDED extensions. + IMAP SORT: Sort keys are indexed, which makes SORT commands faster. + IMAP THREAD: Threads are indexed into a dovecot.index.thread file. It can usually be updated incrementally, so this makes THREAD fast. + Added Dovecot-specific X-REFERENCES2 threading algorithm. It's similar to REFERENCES, but it doesn't do base subject merging and it sorts the threads by their newest message. + When saving messages, update cache file immediately with the data that we expect client to fetch later. Maildir-only currently. + NFS attribute and data caches are are flushed whenever needed. See mail_nfs_storage and mail_nfs_index settings. + Mailbox list indexes. Mailbox metadata is stored there, so STATUS commands can return synchronized mailboxes' metadata simply by reading a single mailbox list index file. Currently works only with Maildir++ layout. + Out of order command execution (SEARCH, FETCH, LIST), nonstandard command cancellation (X-CANCEL <tag>) + Expire plugin can be used to keep track of oldest messages in specific mailboxes. A nightly run can then quickly expunge old messages from the mailboxes that have them. The tracking is done using lib-dict, so you can use either Berkeley DB or SQL database. + Namespaces are supported everywhere now. + Full text search indexing support with Lucene and Squat backends. + OTP and S/KEY authentication mechanisms (by Andrey Panin). + mbox and Maildir works with both Maildir++ and FS layouts. You can change these by appending :LAYOUT=maildir++ or :LAYOUT=fs to mail_location. + LDAP: Support templates in pass_attrs and user_attrs + Support for listening in multiple IPs/ports. + Quota plugin rewrite: Support for multiple quota roots, warnings, allow giving storage size in bytes or kilo/mega/giga/terabytes, per-mailbox quota rules.

1 0