- dovecot - dovecot.org

[Dovecot] Security hole #2: Off-by-one buffer overflow with mmap_disable=yes
by Timo Sirainen 19 Nov '06

19 Nov '06

Version: 1.0test53 .. 1.0.rc14 (ie. all 1.0alpha, 1.0beta and 1.0rc versions so far). 0.99.x versions are safe (they don't even have mmap_disable setting). Problem: When mmap_disable=yes setting is used, dovecot.index.cache file is read to memory using "file cache" code. It contains a "mapped pages" bitmask buffer. In some conditions when updating the buffer it allocates one byte too little. Exploitability: I think it's going to be pretty difficult to cause anything else than a crash, but I wouldn't say impossible. Only logged in IMAP/POP3 users can exploit this. In theory you might be able to exploit this for other users as well by sending them a lot of specially crafted emails, but this requires knowing what dovecot.index.cache file contains. Normally its contents can't be predicted, although perhaps with POP3 users it gets empty often enough that the exploit could be tried. Then again, the exploit requires having at least 4MB cache file, which won't happen with POP3 users before the mailbox has about 170k mails (if I counted right). With IMAP the cache file is used more, so it's easier to fill the 4MB with for example a lot of To-headers. Workaround: Use INDEX=MEMORY so the cache files aren't used at all. Fix: 1.0.rc15 fixes this. You can also use this patch: http://dovecot.org/patches/1.0/file-cache-buffer-overflow-fix.diff

1 0

[Dovecot] I/O leak
by Jim Horner 19 Nov '06

19 Nov '06

I upgraded from rc12 to rc14 last night... sifting through the logs I noticed the following. I point this out since it appears dovecot is in high gear bug-fix mode. This issue is not big for me; I rarely stop dovecot. My init.d script for dovecot is basically stop) killall dovecot imap-login I am guessing there might be a more graceful way to stop dovecot? Or rc14 fixed this? I see in rc14 changelog: - rc13 crashed if client disconnected while IDLEing but only user1 was IDLE. Nov 15 21:53:23 myserver dovecot: IMAP(user1(a)arinbe.com): Disconnected in IDLE Nov 15 21:53:23 myserver dovecot: imap-login: Killed with signal 15 Nov 15 21:53:23 myserver dovecot: IMAP(user2(a)arinbe.com): Disconnected Nov 15 21:53:23 myserver dovecot: imap-login: Killed with signal 15 Nov 15 21:53:23 myserver dovecot: IMAP(user3(a)arinbe.com): Disconnected Nov 15 21:53:23 myserver dovecot: imap-login: Killed with signal 15 Nov 15 21:53:23 myserver dovecot: I/O leak: 0x804d7a0 (17) Nov 15 21:53:23 myserver dovecot: I/O leak: 0x804d7a0 (15) Nov 15 21:53:23 myserver dovecot: I/O leak: 0x804d7a0 (19) Nov 15 21:53:30 myserver postfix/master[31974]: terminating on signal 15 Nov 15 21:54:02 myserver dovecot: Dovecot v1.0.rc14 starting up Jim

2 2

[Dovecot] 1.0.rc14 released
by Timo Sirainen 19 Nov '06

19 Nov '06

http://dovecot.org/releases/dovecot-1.0.rc14.tar.gz http://dovecot.org/releases/dovecot-1.0.rc14.tar.gz.sig More fixes. "Duplicate header extension keywords" is the only known problem (or if I forgot something, remind me). I'll try to figure out a way to reproduce it easily and then get it fixed. * LDAP: Don't try to use ldap_bind() with empty passwords, since Windows 2003 AD skips password checking with them and just returns success. * verbose_ssl=yes: Don't bother logging "syscall failed: EOF" messages. No-one cares about them. + Dovecot sources should now compile without any warnings with gcc 3.2+ - rc13 crashed if client disconnected while IDLEing - LDAP: auth_bind=yes fixes - %variables: Fixed zero padding handling and documented it. %0.1n shouldn't enable it, and it really shouldn't stay for the next %variable. -sign also shouldn't stay for the next variable. - Don't leak opened .log.2 transaction logs. - Fixed a potential hang in IDLE command (probably really rare). - Fixed potential problems with client disconnecting while master was handling the login. - quota plugin didn't work in Mac OS X

4 7

[Dovecot] quota plugin enhancement request
by Michael Tibben 19 Nov '06

19 Nov '06

Hi am having a small issue with the quota plugin In Squirrelmail when a message is deleted, it seems to be copied to the Trash folder *before* it is deleted from the current folder. However if it is a large message being deleted and the mailbox is close to its quota limit, it means dovecot will deny the copy operation as the quota will be exceeded if the message is copied Because of this, I am wondering if it is possible to have an option for the quota plugin to track, but not enforce the quota. This is because I don't require quota enforcement on IMAP, as Postfix will enforce quota on incoming mail anyway. I hope this makes sense... Michael

5 6

[Dovecot] Is "Resource temporarily unavailable" an old problem?
by Ricardo Dias Campos 19 Nov '06

19 Nov '06

Hi. I've installed dovecot recently in a Fedora 5 Linux. It seemed to be OK but I begun to get the message "Can't connect to auth server at default: Resource temporarily unavailable". When I get the message, dovecot hangs. The problem is that "temporarily" is not quite true since the only way to get dovecot running again is to restart it. As a matter of fact, I cannot say that it never recovers. What I know is that it is out for a long, long time. Then a new problem arose: the time between hang-ups begun to diminish. Trying to find why I discovered that the number or dovecot-auth processes was too high (last time I got 169 processes, a lot of them <defuncts>). It seems that, if I kill all these processes, it takes more time before it hangs again. I looked up for messages in the Internet and I found a mail exchange between people from this list. The first hint I got was to upgrade dovecot. As I said, I'm using Fedora 5 and the version distributed with it was dovecot-1.0-0.beta2.7.i386. I upgraded it to dovecot-1.0-0.beta8.2.fc5.i386. I couldn't make any direct relantionship between this versions and the ones in dovecot site so I cannot tell what dovecot version I'm using in terms of dovecot site versioning. Any help is welcome. Thanks, Ricardo

3 3

[Dovecot] CHANGE REQUEST: Move config files out of main $sysconfdir
by Brian G. Peterson 19 Nov '06

19 Nov '06

Currently, dovecot places it's config files in $sysconfdir In Makefile.am, this is defines as: confdir = $(sysconfdir) It would be far more friendly to an already overloaded /etc/ directory, and easier to locate the files, to follow the now-common convention and place files in $sysconfdir / dovecot / ... on most systems this would mean: /etc/dovecot/ If there is only a dovecot.conf, it doesn't really matter, but when additional config files get added for ldap, sql, sieve, it starts to add up. Some distributions already make this change, but placing this change in the dovecot core would make it unnecessary for downstream packagers to make a change to the core dovecot distribution files. Regards, - Brian

3 2

Re: [Dovecot] NTLM authentication from Outlook
by Lars Skovgaard 19 Nov '06

19 Nov '06

> Hi all > > I've enabled ntlm authentication in dovecot, and use dovecot sasl in > postfix as well. > > Authentication with ntlm works well from Mac OS X Mail.app, as well > as from Outlook Express, but fails with Outlook. Strangely enough, > ntml authentication works in Outlook when using smtp (via postfix), > but neither from imap or pop3 (both dovecot). As dovecot sasl handles > all authentication against a mysql userdb, this strikes me as very > strange. > > I've instructed my clients with Outlook to fetch mail using a ssl- > encrypted connection, and to send using ntlm-authentication. This > works, but I would like to have ntlm available as an option to all my > clients, without forcing them to change mail-clients. > > I've turned on auth_verbose, auth_debug and auth_debug_passwords, and > compared the passwordstring with the one calculated using dovecotpw, > and they match. The only odd thing is that the username is returned > from Outlook as an all-caps string, so user(a)domain.tld becomes > USER(a)DOMAIN.TLD. I don't know if it matters, but I don't think so, as > changing the user-login to an all-caps version doesn't solve the > problem. > > Any hints will be most welcome. > > /Lars Greetings, everyone I'm sorry, but I seem to have made a mistake regarding the passwordstring from Outlook – seems like the string I looked at was from MS Entourage... (that's what you get from trying to debug something when you're too tired to think straight). I've now enabled debugging again, and have tried logging in from Outlook with ntlm-authentication. The log-entries are as follows: Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: AUTH 1 NTLM service=IMAP lip=192.168.2.2 rip=192.168.2.13 Nov 16 23:29:09 SD-Server dovecot: auth(default): client out: CONT 1 Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: CONT 1 TlRM7IIog0ADQAuAAAFASgKAAAAD0AABgATVNTUAABYUEFSQkVKRFNHUlVQUAAAABGACgAAA lNQUNEU= Nov 16 23:29:09 SD-Server dovecot: auth(default): client out: CONT 1 TlRMTVNAAAAFAHgAeAAAAAAAADAA +H1XooTUAACAAAAyZ9yMNkAAdgBlAHIALgBsAG8AACYAJgBOAAAAUwBEAC0AUwBlAHIAYwBh AGwAAwAeAFMAyAC4AbABvsAAAAAGMAYRAAtAFMAZQByAHYAZQBQBAAA= Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: CONT 1 TlRMAYAHwAAAAYABgAlAAAAAwADTVNTUAFQAAAAMAAAAAAAAEAH3ZyprYRPWIAAAAAAcgBkA EkATQBBAEMAWABQAAAAACsAAADAAAAGAABIAqMx1XpiwbAAAHAAcwAcABQNAEEAQwBYAFAAT ABpAHMAYQAgAFMAawBvAHYAZwBhAGAAAAAKIAgUBKAoAAAAPSQBAAAAAAAAAAAJILBz4x4RA Ixsp2rhFi8VB6g== Nov 16 23:29:09 SD-Server dovecot: auth(default): ntlm(?, 192.168.2.13): Username contains disallowed characters Nov 16 23:29:10 SD-Server dovecot: auth(default): client out: FAIL 1 The same account logs in without problems if I use a plaintext password (SSL-encrypted, since plaintext-login is disabled). in dovecot.conf I have the following: auth default { mechanisms = plain digest-md5 cram-md5 ntlm rpa } The authentication is done against a mysql-db, which until now has worked with every client I've tested (except Outlook). I have set up postfix to use dovecot-sasl, and use the same userdb for smtp-authentication. Strangely enough the exact same data is accepted when using ntml-authentication with smtp, though a warning is added to my logs. This is an example of a log-entry from an Outlook-user sending a mail: Nov 14 16:40:49 SD-Server postfix/smtpd[8354]: connect from unknown [hid.den.ip.adr] Nov 14 16:40:49 SD-Server dovecot: auth-worker(default): mysql: Connected to localhost (dovecot_auth) Nov 14 16:40:51 SD-Server postfix/smtpd[8354]: warning: unknown [hid.den.ip.adr]: SASL NTLM authentication failed: TlRMTVNTUAACAAMAZYAAQByAHAFAooAOINYZ// +97QAAAAAAAAUwBEAC0AUwBlAHIAdgBlAHIALgBsAG8AYwBhAGwAAwAeAFMARAAtAFAbABvA GMAYAAAAHgAeADAQAAAAAACYAJgBOBZQByAC4sAAAAAAA= Nov 14 16:40:51 SD-Server postfix/smtpd[8354]: AC6402D668E: client=unknown[hid.den.ip.adr], sasl_method=NTLM, sasl_username=user(a)domain.dk Nov 14 16:40:51 SD-Server postfix/cleanup[8358]: AC6402D668E: message- id=<006a01c70803$4dcd1b00$0200a8c0@acerce5220052b> Nov 14 16:41:13 SD-Server postfix/qmgr[8494]: AC6402D668E: from=<user(a)domain.dk>, size=819330, nrcpt=1 (queue active) Nov 14 16:41:16 SD-Server postfix/smtpd[8354]: disconnect from unknown [hid.den.ip.adr] Nov 14 16:41:29 SD-Server postfix/smtp[8361]: AC6402D668E: to=<user(a)otherdomain.dk>, relay=smtp.domain.dk[hid.den.ip.adr]:25, delay=37, delays=22/0.08/0.06/15, dsn=2.0.0, status=sent (250 156794624 mailfe12 Message accepted for delivery) Nov 14 16:41:29 SD-Server postfix/qmgr[8494]: AC6402D668E: removed The same warning is issued from postfix when a user sends mail from Outlook Express, but not when the same user sends from Thunderbird or Mail.app. In fact, I've only seen these problems when the users are using MS products. I really hope someone can shed some light on what is going on. Best regards Lars

2 1

[Dovecot] dovecot:IMAP(user) killed with signal 6
by Spil Oss 18 Nov '06

18 Nov '06

Hi all, After rc10 I have problems with imap and imaps Hi all, After rc10 I have problems with imap and imaps Nov 16 15:42:39 beastie dovecot: IMAP(user1): open(/home/user1/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:44:09 beastie dovecot: IMAP(user2): open(/home/user2/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:44:09 beastie dovecot: IMAP(user2): file maildir-keywords.c: line 222 (maildir_keywords_lookup_or_create): assertion failed: (mk->synced) Nov 16 15:44:09 beastie dovecot: child 98798 (imap) killed with signal 6 Nov 16 15:46:10 beastie dovecot: IMAP(user2): open(/home/user2/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:46:10 beastie dovecot: IMAP(user2): file maildir-keywords.c: line 222 (maildir_keywords_lookup_or_create): assertion failed: (mk->synced) Nov 16 15:46:10 beastie dovecot: child 98819 (imap) killed with signal 6 The Permission denied messages where there in rc10 as well, but that was not causing problems. These folders are symlinks to shared spam and ham folders for spamassassin learning. Any clue on how to fix this? FreeBSD-i386 6.1-RELEASE-p10 dovecot-1.0.r13 from ports Kind regards, Spil.

3 3

[Dovecot] updated gentoo ebuild provides dovecot-sieve
by Brian G. Peterson 18 Nov '06

18 Nov '06

I'm hoping that there are some Gentoo users on this list who will chime in on a bug that is near and dear to my heart. We've created an updated Gentoo ebuild that adds a sieve USE flag and builds dovecot-sieve if the use flag is enabled. The gentoo bug is here: https://bugs.gentoo.org/show_bug.cgi?id=141743 and the ebuild is available as an attachment to that bug, or as a patch attachment (in case you're not running rc14, or just prefer the look of a unified diff) Any gentoo users on this list are urged to install from the ebuild/patch on the bug, and *report back* on the bug or this list, so that the Gentoo dev will know that it's safe to add this to portage CVS. Thank You. Regards, - Brian

2 1

[Dovecot] Dovecot LDA, LDAP, Postfix and Spawning programs..
by Jorgen Lundman 18 Nov '06

18 Nov '06

Qmail, when using LDAP, a user can specify delvieryProgramPath, or a .qmail file, to launch something like procmail. Qmail correctly setuid() to the uids set for the user in LDAP, as well as set up the common env vars (HOME, USER, MAILDIR). We moved to Postfix but found that it is quite lacking in the features supported when it comes to "virtual" users. No .forward, and if you set up an alternate transport, they are run as "any user but root, nor postfix, nor the virtual-user's uid". And worse, does not even supply the HOME/MAILDIR values to transport delivery plugin. (Forcing it to getpwnam() or similar). I have an option to make my own setuid program to query LDAP (postmap -q would work), setuid() and call, say, procmail. It has been suggested I can use "maildrop" as it can talk to LDAP. However, I picked "Dovecot" as my pop3/imap program due to an irrational dislike of Courier imap. So, if I tried Dovecot-LDA, would it support the user optionally having a ".forward" file, or perhaps the LDAP attribute deliveryProgramPath, or some other way to filter based on subject/body to sort, and/or forward, mail? If it can use LDAP, will it setuid() to the users uid (as set in LDAP, assuming I cook the LDAP conf entries correctly) when delivering(I'd hope so!) and running external filters? I am still running rc10, which works well but flips out regularly. (Previously mentioned 'too many files open' bug, some leaks in locks) I will upgrade when the LDAP changes are deemed stable. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

2 1