August 2020 - dovecot

Correcting Mail Home, Maildir and Sieve folder locations
by David White 13 Aug '20

13 Aug '20

I have Dovecot 2.3.7.2 on Ubuntu 20.04. I just migrated the server from CentOS 8, and only migrated to the CentOS 8 machine a few months ago off of CentOS 7. I am pasting `doveconf -n` at the bottom of this email. Everything is working. However, I'm trying to clean up warnings in the logs, and just discovered that I'm not managing home directories properly. (c/f https://wiki.dovecot.org/VirtualUsers/Home) This is in the logs: > Jun 28 06:09:50 mail.example.com dovecot: imap(email(a)example.com)<3786><fICEJCKpbfatQHg1>: Error: stat(/var/vmail/example.com/email@example.com/.dovecot.sieve/tmp) failed: Not a directory Can I please get a sanity check? To resolve, I've come up with a bash loop to create a home folder, and fix the existing structure for each mailbox on the system. I ran this for 1 of the domains on the system. > for i in */ ; do mv "$i" mail; mkdir "$i"; mv mail "$i"; mv "$i"/.dovecot* "$i"; done Then, I would simply edit /etc/dovecot/conf.d/10-mail.conf so that it looks like this: > mail_home = /var/vmail/%d/%u > mail_location = maildir:/var/vmail/%d/%u/mail To confirm, should all of the 'hidden' dovecot files be moved to the user's new home folder like I'm trying to do in the above script? Or are there other files that I will need to move? After running that loop above on a test server (don't worry, I would never do this in production without testing), one of the mailbox's home folder on the server looks like this: > total 56 > drwxr-xr-x 4 vmail vmail 4096 Jun 28 06:19 . > drwx------ 6 vmail vmail 4096 Jun 28 06:09 .. > -rw------- 1 vmail vmail 54 Jul 4 2019 .dovecot.lda-dupes > lrwxrwxrwx 1 vmail vmail 21 May 26 2016 .dovecot.sieve -> sieve/roundcube.sieve > -rw------- 1 vmail vmail 0 Oct 17 2016 .dovecot.sieve.log > -rw------- 1 vmail vmail 218 Jul 6 2019 .dovecot.svbin > drwx------ 277 vmail vmail 32768 Jun 28 06:19 mail > drwx------ 3 vmail vmail 4096 Feb 2 17:31 sieve ... and connecting to that mailbox over Thunderbird seems to be working fine. But I want to make sure I'm not missing anything. Here is my doveconf -n, with identifying information snipped out: > root@mail:# doveconf -n > # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.7.2 () > # OS: Linux 5.4.0-39-generic x86_64 Ubuntu 20.04 LTS ext4 > # Hostname: {snip} > auth_mechanisms = plain login > mail_location = maildir:/var/vmail/%d/%u > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > namespace inbox { > inbox = yes > location = > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Spam { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = subscribe > special_use = \Trash > } > prefix = > } > passdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > } > protocols = imap pop3 lmtp sieve > service auth-worker { > user = $default_internal_user > } > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-userdb { > group = postfix > mode = 0666 > user = vmail > } > } > service lmtp { > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = postfix > mode = 0666 > user = postfix > } > } > ssl = required > ssl_ca = </etc/ssl/certs/snip.ca-bundle > ssl_cert = </etc/ssl/certs/snip.crt > ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL:!MD5 > ssl_key = # hidden, use -P to show it > userdb { > args = uid=vmail gid=vmail home=/var/vmail/%d/%u > driver = static > } Sent with ProtonMail Secure Email.

1 1

Pigeonhole 0.5.11 released
by Aki Tuomi 13 Aug '20

13 Aug '20

We are pleased to release pigeonhole 0.5.11. You can download it from locations below: https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3.11-pigeonhole-0.5.1… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3.11-pigeonhole-0.5.1… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- * managesieve: managesieve_max_line_length setting is now a "size" type instead of just number of bytes. This allows using e.g. "64k" as the value. - lib-sieve: When folding white space is used in the Message-ID header, it is not stripped away correctly before the message ID value is used, causing e.g. garbled log lines at delivery.

5 9

Problems, virtual and alias, Dovecot, Neomutt, OpenSMTPD on OpenBSD
by Chris Bennett 12 Aug '20

12 Aug '20

I'm having some problems. I'm using virtual users with real domains. That is working, but the folders are not showing up properly in neomutt, for both virtual users and system users. When I use K9 on Android, the folders show up correctly. Sending is working, but I don't have auth setup right on OpenSMTPD, so I'm sending locally, not remotely (including from K9, which can't login to send). That's really probably not relevant here, but I thought I'd mention it. I'm a bit embarrassed to admit that after having to move everything off of one server super rapidly to another already working to save money, I realized that I had made some wrong assumptions. Oops but +1 for me. So now I know what to fix there and why. If anyone has a good .neomuttrc or hints, I would appreciate that help. But I can save that problem for the neomutt mailing list. Here are copies of my doveconf -n, dovecot/passwd, vaddr, vdomains and vusers. Obscured of course. Plus the DNS IP's of this server and the one other server, which isn't running dovecot yet. Everything is using maildir on both servers. DNSSEC on all but bennettconstruction.us and mail.bennettconstruction.us Is there anything wrong, missing or screwed up here? I do intend to use encrypted passwds once I get submission to OpenSMTPD working and add the right ports for that. So far, I really haven't found the three different dovecot logs to be particularly helpful, but I can send excerpts of those if helpful. Thanks. I appreciate any help. This is my first go at IMAP and someone sent me some config info a while ago, which really helped a ton. I really like this software, I used it previously a few years ago for POP3. I do find the documentation missing some sample configs with some explanations for why and how. At some point I would like to add some more complicated things, but I don't understand what some config options really do. I also understand that documentation vs. code work are always in conflict. 28 hour days would really help! :-} doveconf -n: # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (bf8ef1c2) # OS: OpenBSD 6.7 amd64 ffs # Hostname: cowboyup.xyz auth_debug = yes auth_debug_passwords = yes auth_socket_path = /var/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = sha1 debug_log_path = /var/log/dovecot-debug.log first_valid_uid = 1000 hostname = consulting-diy-construction.com imap_id_log = * imap_id_send = * info_log_path = /var/log/dovecot-info.log lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_client_workarounds = whitespace-before-path mailbox-for-path log_path = /var/log/dovecot.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_debug = yes mail_location = maildir:/home/vmail/%n@%d/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes } passdb { driver = bsdauth } passdb { args = /etc/dovecot/passwd driver = passwd-file } plugin { mail_log_fields = uid box msgid size sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)consulting-diy-construction.com protocols = imap lmtp sieve service auth-worker { user = root } service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } service_count = 1 } service imap { process_limit = 1024 } service lmtp { unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } ssl_dh = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/home/vmail/%n@%d driver = static } verbose_ssl = yes protocol lmtp { mail_plugins = } protocol imap { mail_max_userip_connections = 10 mail_plugins = } protocol lda { mail_plugins = } local 172.107.198.230 { ssl_cert = </etc/ssl/mx.no-seas-necio.ninja.fullchain.pem ssl_key = # hidden, use -P to show it } local 172.107.198.231 { ssl_cert = </etc/ssl/mail.freedomforlife.rocks.fullchain.pem ssl_key = # hidden, use -P to show it } local 172.107.198.229 { ssl_cert = </etc/ssl/mail.consulting-diy-construction.com.fullchain.pem ssl_key = # hidden, use -P to show it } vaddr: #root(a)consulting-diy-construction.com #abuse(a)consulting-diy-construction.com #security(a)consulting-diy-construction.com #hostmaster(a)consulting-diy-construction.com webmaster(a)consulting-diy-construction.com postmaster(a)consulting-diy-construction.com ch(a)consulting-diy-construction.com fr(a)consulting-diy-construction.com ro(a)consulting-diy-construction.com di(a)no-seas-necio.ninja kl(a)no-seas-necio.ninja ff(a)freedomforlife.rocks ff6(a)freedomforlife.rocks chris-dvcot(a)freedomforlife.rocks postmaster(a)freedomforlife.rocks postmaster(a)consulting-diy-construction.com vdomains: consulting-diy-construction.com no-seas-necio.ninja freedomforlife.rocks bennettconstruction.us vusers: root(a)consulting-diy-construction.com ro(a)consulting-diy-construction.com root(a)cowboyup.xyz ro(a)consulting-diy-construction.com root(a)freedomforlife.rocks ro(a)consulting-diy-construction.com webmaster(a)consulting-diy-construction.com ro(a)consulting-diy-construction.com chris(a)cowboyup.xyz ro(a)consulting-diy-construction.com chris(a)consulting-diy-construction.com ro(a)consulting-diy-construction.com fr(a)cowboyup.xyz vmail fr fr(a)consulting-diy-construction.com ro ro(a)consulting-diy-construction.com fr(a)consulting-diy-construction.com vmail ro(a)consulting-diy-construction.com vmail di dirkly(a)no-seas-necio.ninja kl(a)no-seas-necio.ninja vmail di(a)no-seas-necio.ninja vmail chris-dvcot(a)freedomforlife.rocks vmail postmaster(a)freedomforlife.rocks vmail postmaster(a)consulting-diy-construction.com vmail dovecot/passwd: #ro@consulting-diy-construction.com:{BLF-CRYPT}$2b$MEe:::::: #ro@cowboyup.xyz:{BLF-CRYPT}$2b$MEe:::::: #ch@consulting-diy-construction.com:{BLF-CRYPT}$2b$MEe:::::: #ch@cowboyup.xyz:{BLF-CRYPT}$2b$MEe:::::: #di@no-seas-necio.ninja:{BLF-CRYPT}$2b$9QZ. #vmail:{BLF-CRYPT}$2b$fG6:::::: ro@consulting-diy-construction.com:{PLAIN}46:::::: ro@cowboyup.xyz:{PLAIN}46:::::: ro:{PLAIN}46:::::: fr@consulting-diy-construction.com:{PLAIN}46:::::: fr@cowboyup.xyz:{PLAIN}46y:::::: fr:{PLAIN}Xella#%46:::::: di:{PLAIN}Xella#%46:::::: di@no-seas-necio.ninja:{PLAIN}46:::::: di@consulting-diy-construction.com:{PLAIN}46:::::: di@cowboyup.xyz:{PLAIN}46:::::: kl@no-seas-necio.ninja:{PLAIN}46:::::: chris-dvcot@freedomforlife.rocks:{PLAIN}68:::::: postmaster@freedomforlife.rocks:{PLAIN}68:::::: postmaster@consulting-diy-construction.com:{PLAIN}68:::::: This server: OpenBSD 6.7-current (GENERIC.MP) #22: Tue Aug 11 21:29:51 MDT 2020 172.107.198.226 cowboyup.xyz 172.107.198.227 no-seas-necio.ninja 172.107.198.228 consulting-diy-construction.com 172.107.198.229 mail.consulting-diy-construction.com 172.107.198.230 mx.no-seas-necio.ninja 172.107.198.231 mail.freedomforlife.rocks 172.107.198.232 mail.bennettconstruction.us 172.107.198.233 bennettconstruction.us 172.107.198.234 capuchado.com 172.107.198.235 strengthcouragewisdom.rocks Other server: OpenBSD 6.7-current (GENERIC.MP) #22: Tue Aug 11 21:29:51 MDT 2020 172.107.202.138 freedomforlife.rocks 172.107.202.139 mail.no-seas-necio.ninja 172.107.202.140 mail.cowboyup.xyz 172.107.202.141 mail.strengthcouragewisdom.rocks 172.107.202.142 mail.capuchado.com

1 0

Can't move/delete folder "Renaming not supported across conflicting directory permissions"
by Johannes Rohr 12 Aug '20

12 Aug '20

Dear all, several users have reported that they were unable to move/delete folders using Thunderbird and they got the message "Renaming not supported across conflicting directory permissions". When I google for this message, I see hints like "your mail may not be all on the same volume", but here this is definitely not the case. All mail is in /var/mail/virtual and owned by mail:mail Curiously, when I tried the same operation in Roundcube, there was no error reported, so something about the combination of Thunderbird and Dovecot seems to be causing the error. Does anyone have advise on how I should go about tracking down the cause of the error? Thanks a lot in advance! Johannes

3 2

Replication: Mails deleted over POP3 aren't deleted at the same time from the second server
by Lukas 12 Aug '20

12 Aug '20

Hi, I have two Dovecot 2.3.8 (on RHEL 8.2) servers. Replication works great except in one situation. What works: * If one server receives an email, it is immediately available on the other server. * If an email is deleted via IMAP from one server, it is immediately deleted from the other server. What doesn't work: If a user retrieves (download + delete) an email via POP3 (Thunderbird), then the mail is only deleted from the server from which it was downloaded but not from the other server. The email is only deleted from the other server in the following situations: * If a new email arrives (triggers a sync action) * When the next full sync happens (I temporarily set replication_full_sync_interval to "1 hour") * When forcing a manual full sync (doveadm replicator replicate user_name) If I activate debug logging (mail_debug = yes), I can immediately see a replication action when an email is deleted via IMAP. However, when an email is deleted via POP3, nothing is logged (because no replication happens). Does anyone have an idea why deleting an email via POP3 isn't replicated and how to configure this? Thanks for your help. Lukas My config (it is identical on on both servers, except of the "mail_replica" and "address" parameters): auth_mechanisms = plain login auth_username_format = %n doveadm_password = # hidden, use -P to show it doveadm_port = 12345 login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_gid = vmail mail_home = /var/spool/dovecot/%u mail_location = sdbox:/var/spool/dovecot/%u mail_plugins = " notify replication" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/deny.%s deny = yes driver = passwd-file } passdb { args = scheme=SSHA512 username_format=%n /etc/dovecot/passwd driver = passwd-file } plugin { mail_replica = tcps:server2.example.com:12345 sieve = ~/sieve/.dovecot.sieve } protocols = imap pop3 lmtp sieve replication_full_sync_interval = 1 hours service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = $default_internal_user } service doveadm { inet_listener { address = ... port = 12345 ssl = yes } user = vmail } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = ... port = 993 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { address = ... port = 4190 } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { address = ... port = 995 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/letsencrypt/live/server1.example.com/fullchain.pem ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression syslog_facility = local5 userdb { args = username_format=%n /etc/dovecot/passwd driver = passwd-file result_failure = return-fail result_internalfail = return-fail } protocol sieve { ssl = required } protocol lmtp { mail_plugins = " notify replication sieve" }

1 0

auth debug log entry incorrect
by Tomas Habarta 12 Aug '20

12 Aug '20

Hello, just want to report a slightly confusing log entry on auth-debug level I have encountered while setting up Kerberos auth. Users are stored in ldap, Kerberos makes use of the same ldap as its backend, goal was to enable users to use their principals in addition to simple login with mailAddress/userPassword combination. Sample entry relevant attrs: --- mailAddress: sn.gn(a)example.com mailDeliveryAddress: 123456(a)example.com uid: u123456 krbPrincipalName: u123456@REALM krbPrincipalName: user123456@REALM krbPrincipalName: alias@REALM --- with pass_attrs = =user=%{ldap:mailDeliveryAddress},=password=%{ldap:userPassword},=k5principals=%{ldap:krbPrincipalName} I can see incorrectly logged ldap search result for krbPrincipalName attr as it is written 3 times with the same value -- number is correct, values should differ. All is working ok as expected, but was a bit confusing while tuning /etc/krb5.conf on non-working remote client whilst local client had no issues (mutt). Anyway, to eventually save someone's time, this seems to be easy enough to be fixed. Thanks for this great software, Tomas dovecot[13337]: auth: Debug: ldap(sn.gn(a)example.com,10.0.9.14,<6xHsI62sJoWT+2C4>): result: mailDeliveryAddress=123456(a)example.com krbPrincipalName=u123456@REALM,u123456@REALM,u123456@REALM; krbPrincipalName,mailDeliveryAddress unused dovecot[13337]: auth: Debug: ldap(sn.gn(a)example.com,10.0.9.14,<6xHsI62sJoWT+2C4>): username changed sn.gn(a)example.com -> 123456(a)example.com dovecot[13337]: auth: Warning: ldap(123456(a)example.com,10.0.9.14,<6xHsI62sJoWT+2C4>): Multiple values found for 'krbPrincipalName', using value 'u123456@REALM' dovecot[13337]: auth: Debug: ldap(123456(a)example.com,10.0.9.14,<6xHsI62sJoWT+2C4>): Finished passdb lookup dovecot[13337]: auth: Debug: gssapi(123456(a)example.com,10.0.9.14,<6xHsI62sJoWT+2C4>): authorized by k5principals field: u123456@REALM dovecot[13337]: auth: Debug: auth(123456(a)example.com,10.0.9.14,<6xHsI62sJoWT+2C4>): Auth request finished dovecot[13337]: auth: Debug: client passdb out: OK 1 user=123456(a)example.com k5principals=u123456@REALM original_user=u123456@REALM dovecot[13337]: auth: Debug: master in: REQUEST 3251372033 13340 1 3bbd5f6931fe4e949e7822657da9e33b session_pid=13343 request_auth_token # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 4.18.0-193.14.2.el8_2.x86_64 x86_64 CentOS Linux release 8.2.2004 (Core)

1 0

CVE-2020-12674: Specially crafted RPA authentication message crashes auth
by Aki Tuomi 12 Aug '20

12 Aug '20

Open-Xchange Security Advisory 2020-08-12 Affected product: Dovecot IMAP server Internal reference: DOP-1869 (Bug ID) Vulnerability type: CWE-126 (Buffer over-read) Vulnerable version: 2.2 Vulnerable component: auth Fixed version: 2.3.11.3 Report confidence: Confirmed Solution status: Fix available Vendor notification: 2020-05-03 Researcher credit: Orange from DEVCORE team CVE reference: CVE-2020-12674 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Dovecot's RPA mechanism implementation accepts zero-length message, which leads to assert-crash later on Risk: An adversary can use this vulnerability to crash dovecot auth process repeatedly, preventing login. Steps to reproduce: (echo 'AUTH RPA'; echo -ne '\x60\x11\x06\x09\x60\x86\x48\x01\x86\xf8\x73\x01\x01\x01\x00\x04\x00\x00\x01' | base64 -w 0; echo ; echo -ne '\x60\x11\x06\x09\x60\x86\x48\x01\x86\xf8\x73\x01\x01\x00\x03A@A\x00' | base64 -w 0; echo ; echo QUIT) | nc 127.0.0.1 110 Workaround: Disable RPA authentication. Solution: Upgrade to fixed version. Best regards, Aki Tuomi Open-Xchange oy

1 0

CVE-2020-12673: Specially crafted NTML package can crash auth service
by Aki Tuomi 12 Aug '20

12 Aug '20

Open-Xchange Security Advisory 2020-08-12 Affected product: Dovecot IMAP server Internal reference: DOP-1870 (Bug ID) Vulnerability type: CWE-789 (Uncontrolled Memory Allocation) Vulnerable version: 2.2 Vulnerable component: auth Fixed version: 2.3.11.3 Report confidence: Confirmed Solution status: Fix available Vendor notification: 2020-05-03 CVE reference: CVE-2020-12673 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash. Risk: An adversary can use this vulnerability to crash dovecot auth process repeatedly, preventing login. Steps to reproduce: (echo 'AUTH NTLM'; echo -ne 'NTLMSSP\x00\x01\x00\x00\x00\x00\x02\x00\x00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' | \ base64 -w0 ;echo ;echo -ne 'NTLMSSP\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00AA\x00\x00\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00orange\x00'| \ base64 -w0;echo ; echo QUIT) | nc 127.0.0.1 110 Workaround: Disable NTLM authentication. Solution: Upgrade to fixed version. Best regards, Aki Tuomi Open-Xchange oy

1 0

CVE-2020-12100: Receiving mail with deeply nested MIME parts leads to resource exhaustion.
by Aki Tuomi 12 Aug '20

12 Aug '20

Open-Xchange Security Advisory 2020-08-12 Affected product: Dovecot IMAP server Internal reference: DOP-1849 (Bug ID) Vulnerability type: Uncontrolled recursion (CWE-674) Vulnerable version: 2.0 Vulnerable component: submission, lmtp, lda Fixed version: 2.3.11.3 Report confidence: Confirmed Solution status: Fix available Vendor notification: 2020-04-23 CVE reference: CVE-2020-12100 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Receiving mail with deeply nested MIME parts leads to resource exhaustion as Dovecot attempts to parse it. Risk: Malicious actor can cause denial of service to mail delivery by repeatedly sending mails with bad content. Workaround: Limit MIME structures in MTA. Solution: Upgrade to fixed version. Best regards, Aki Tuomi Open-Xchange oy

1 0

Dovecot v2.3.11.3 released
by Aki Tuomi 12 Aug '20

12 Aug '20

We are pleased to release v2.3.11.3. Please find it from locations below: https://dovecot.org/releases/2.3/dovecot-2.3.11.3.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.11.3.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- * CVE-2020-12100: Parsing mails with a large number of MIME parts could have resulted in excessive CPU usage or a crash due to running out of stack memory. * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash. * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an address that has the empty quoted string as local-part causes the lmtp service to crash. * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts zero-length message, which leads to assert-crash later on. * Events: Fix inconsistency in events. See event documentation in https://doc.dovecot.org. * imap_command_finished event's cmd_name field now contains "unknown" for unknown commands. A new "cmd_input_name" field contains the command name exactly as it was sent. * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*. Note that these settings are mainly intended for testing and usually shouldn't be changed. * events: Renamed "index" event category to "mail-index". * events: service:<name> category is now using the name from configuration file. * dns-client: service dns_client was renamed to dns-client. * log: Prefixes generally use the service name from configuration file. For example dict-async service will now use "dict-async(pid): " log prefix instead of "dict(pid): " * *-login: Changed logging done by proxying to use a consistent prefix containing the IP address and port. * *-login: Changed disconnection log messages to be slightly clearer. + dict: Add events for dictionaries. + lib-index: Finish logging with events. + oauth2: Support local validation of JWT tokens. + stats: Add support for dynamic histograms and grouping. See https://doc.dovecot.org/configuration_manual/stats/. + imap: Implement RFC 8514: IMAP SAVEDATE + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge folder) adds a lot of data to dovecot.index.cache file, commit those changes periodically to make them visible to other concurrent sessions as well. + stats: Add OpenMetrics exporter for statistics. See https://doc.dovecot.org/configuration_manual/stats/openmetrics/. + stats: Support disabling stats-writer socket by setting stats_writer_socket_path="". - auth-worker: Process keeps slowly increasing its memory usage and eventually dies with "out of memory" due to reaching vsz_limit. - auth: Prevent potential timing attacks in authentication secret comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result. - auth: Several auth-mechanisms allowed input to be truncated by NUL which can potentially lead to unintentional issues or even successful logins which should have failed. - auth: When auth policy returned a delay, auth_request_finished event had policy_result=ok field instead of policy_result=delayed. - auth: auth process crash when auth_policy_server_url is set to an invalid URL. - auth: Lua passdb/userdb leaks stack elements per call, eventually causing the stack to become too deep and crashing the auth or auth-worker process. - dict-ldap: Crash occurs if var_expand template expansion fails. - dict: If dict client disconnected while iteration was still running, dict process could have started using 100% CPU, although it was still handling clients. - doveadm: Running doveadm commands via proxying may hang, especially when doveadm is printing a lot of output. - imap: "MOVE * destfolder" goes to a loop copying the last mail to the destination until the imap process dies due to running out of memory. - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite loop. - imap: SEARCH doesn't support $. - lib-compress: Buffer over-read in zlib stream read. - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling process. - lib-index: Fixed several bugs in dovecot.index.cache handling that could have caused cached data to be lost. - lib-index: Writing to >=1 GB dovecot.index.cache files may cause assert-crashes: Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) - lib-mail: v2.3.11 regression: MIME parts not returned correctly by Dovecot MIME parser. - lib-ssl-iostream: Fix buggy OpenSSL error handling without assert-crashing. If there is no error available, log it as an error instead of crashing: Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error): assertion failed: (errno != 0) - lib-ssl-iostream: ssl_key_password setting did not work. - pop3-login: Login didn't handle commands in multiple IP packets properly. This mainly affected large XCLIENT commands or a large SASL initial response parameter in the AUTH command. - pop3: pop3_deleted_flag setting was broken, causing: Panic: file seq-range-array.c: line 472 (seq_range_array_invert): assertion failed: (range[count-1].seq2 <= max_seq) - pop3-login: Login would fail with "Input buffer full" if the initial response for SASL was too long. - submission: A segfault crash may occur when the client or server disconnects while a non-transaction command like NOOP or VRFY is still being processed. - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes: Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed: (copy_ctx->copy_count == seq_range_count(&copy_ctx->saved_uids))

1 0