Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2008-0297 advisory.

  - Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the     zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot     dot) sequence in the mailbox name. (CVE-2007-2231)

  - The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save     certain flags via a (1) COPY or (2) APPEND command. (CVE-2007-4211)

  - Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly     maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user     who has the same password. (CVE-2007-6598)

  - Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in     /var/mail, might allow local users to read sensitive mail files for other users, or modify files or     directories that are writable by group, via a symlink attack. (CVE-2008-1199)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the way Dovecot handled the 'mail_extra_groups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199)

This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options
-- 'mail_privileged_group' and 'mail_access_groups' -- to minimize the usage of additional privileges.

A directory traversal flaw was discovered in Dovecot's zlib plug-in.
An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231)

A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the 'COPY' and 'APPEND' commands to set additional message flags. (CVE-2007-4211)

A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598)

As well, this updated package fixes the following bugs :

  - configuring 'userdb' and 'passdb' to use LDAP caused     Dovecot to hang. A segmentation fault may have occurred.
    In this updated package, using an LDAP backend for     'userdb' and 'passdb' no longer causes Dovecot to hang.

  - the Dovecot 'login_process_size' limit was configured     for 32-bit systems. On 64-bit systems, when Dovecot was     configured to use either IMAP or POP3, the log in     processes crashed with out-of-memory errors. Errors such     as the following were logged :

pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

In this updated package, the 'login_process_size' limit is correctly configured on 64-bit systems, which resolves this issue.

Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397

When configured with 'mail_extra_groups' dovecot potentially allowed users to read mail boxes of other users. This is not the case in the default configuration of on openSUSE (CVE-2008-1199).

By using tab characters in passwords remote attackers could potentially acquire unauthorized access (CVE-2008-1218).

Flaws in caching LDAP data could lead to users getting logged in with the wrong account (CVE-2007-6598).

An updated dovecot package that fixes several security issues and various bugs is now available for Red Hat Enterprise Linux 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Dovecot is an IMAP server for Linux and UNIX-like systems, primarily written with security in mind.

A flaw was discovered in the way Dovecot handled the 'mail_extra_groups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199)

This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options
-- 'mail_privileged_group' and 'mail_access_groups' -- to minimize the usage of additional privileges.

A directory traversal flaw was discovered in Dovecot's zlib plug-in.
An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231)

A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the 'COPY' and 'APPEND' commands to set additional message flags. (CVE-2007-4211)

A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598)

As well, this updated package fixes the following bugs :

* configuring 'userdb' and 'passdb' to use LDAP caused Dovecot to hang. A segmentation fault may have occurred. In this updated package, using an LDAP backend for 'userdb' and 'passdb' no longer causes Dovecot to hang.

* the Dovecot 'login_process_size' limit was configured for 32-bit systems. On 64-bit systems, when Dovecot was configured to use either IMAP or POP3, the log in processes crashed with out-of-memory errors.
Errors such as the following were logged :

pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

In this updated package, the 'login_process_size' limit is correctly configured on 64-bit systems, which resolves this issue.

Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397

Users of dovecot are advised to upgrade to this updated package, which resolves these issues.

It was discovered that the default configuration of dovecot could allow access to any email files with group 'mail' without verifying that a user had valid rights. An attacker able to create symlinks in their mail directory could exploit this to read or delete another user's email. (CVE-2008-1199)

By default, dovecot passed special characters to the underlying authentication systems. While Ubuntu releases of dovecot are not known to be vulnerable, the authentication routine was proactively improved to avoid potential future problems. (CVE-2008-1218).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200803-25 (Dovecot: Multiple vulnerabilities)

    Dovecot uses the group configured via the 'mail_extra_groups' setting,     which should be used to create lockfiles in the /var/mail directory,     when accessing arbitrary files (CVE-2008-1199). Dovecot does not escape     TAB characters in passwords when saving them, which might allow for     argument injection in blocking passdbs such as MySQL, PAM or shadow     (CVE-2008-1218).
  Impact :

    Remote attackers can exploit the first vulnerability to disclose     sensitive data, such as the mail of other users, or modify files or     directories that are writable by group via a symlink attack. Please     note that the 'mail_extra_groups' setting is set to the 'mail' group by     default when the 'mbox' USE flag is enabled.
    The second vulnerability can be abused to inject arguments for internal     fields. No exploitation vectors are known for this vulnerability that     affect previously stable versions of Dovecot in Gentoo.
  Workaround :

    There is no known workaround at this time.

Prior to this update, the default configuration for Dovecot used by Debian runs the server daemons with group mail privileges. This means that users with write access to their mail directory on the server (for example, through an SSH login) could read and also delete via a symbolic link mailboxes owned by other users for which they do not have direct access (CVE-2008-1199 ). In addition, an internal interpretation conflict in password handling has been addressed proactively, even though it is not known to be exploitable (CVE-2008-1218 ).

Note that applying this update requires manual action: The configuration setting 'mail_extra_groups = mail' has been replaced with 'mail_privileged_group = mail'. The update will show a configuration file conflict in /etc/dovecot/dovecot.conf. It is recommended that you keep the currently installed configuration file, and change the affected line. For your reference, the sample configuration (without your local changes) will have been written to /etc/dovecot/dovecot.conf.dpkg-new.

If your current configuration uses mail_extra_groups with a value different from 'mail', you may have to resort to themail_access_groups configuration directive.

This update upgrades dovecot from version 1.0.10 to 1.0.13. Besides bug fixes, two security issues were fixed upstream in version 1.0.11 and 1.0.13. CVE-2008-1199 If Dovecot was configured with mail_extra_groups = mail, users having shell access to IMAP server could use this flaw to read, modify or delete mails of other users stored in inbox files in /var/mail. /var/mail directory is mail-group writable and user inbox files are by default created by useradd with permission 660, <user>:mail. No mail_extra_groups is set by default, hence default Fedora configuration was not affected by this problem.
If your configuration sets mail_extra_groups, see new options mail_privileged_group and mail_access_groups introduced in Dovecot 1.0.11. (mail_extra_groups is still accepted, but is deprecated now) CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to gain password-less login via passwords with tab characters, which were not filtered properly. Dovecot versions in Fedora were not affected by this unauthorized login flaw, but only by a related minor memory leak in dovecot-auth worker process. See referenced bugzilla for further details about this flaw.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180598	Oracle Linux 5 : dovecot (ELSA-2008-0297)	Nessus	Oracle Linux Local Security Checks	critical
60404	Scientific Linux Security Update : dovecot on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
34320	openSUSE 10 Security Update : dovecot (dovecot-5647)	Nessus	SuSE Local Security Checks	medium
32423	RHEL 5 : dovecot (RHSA-2008:0297)	Nessus	Red Hat Local Security Checks	medium
31701	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dovecot vulnerabilities (USN-593-1)	Nessus	Ubuntu Local Security Checks	medium
31612	GLSA-200803-25 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
31587	Debian DSA-1516-1 : dovecot - privilege escalation	Nessus	Debian Local Security Checks	medium
31436	Fedora 7 : dovecot-1.0.13-18.fc7 (2008-2475)	Nessus	Fedora Local Security Checks	medium
31434	Fedora 8 : dovecot-1.0.13-6.fc8 (2008-2464)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-1199

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium