Bug 436927 (CVE-2008-1199)
| Summary: | CVE-2008-1199 dovecot: insecure mail_extra_groups option | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | kreilly |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1199 | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-06-02 14:07:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 437152 | ||
| Bug Blocks: | |||
|
Description
Tomas Hoger
2008-03-11 07:52:23 UTC
Upstream patch referenced also in BugTraq post mentioned in initial comment: http://dovecot.org/patches/1.0/dovecot-1.0.10.mail_priv_groups.diff http://hg.dovecot.org/dovecot-1.0/rev/2c61c3cad1f1 Dovecot packages as shipped in Red Hat Enterprise Linux 4 and 5 and Fedora do
not set mail_extra_groups by default.
User mailboxes are created in /var/(spool/)mail/ directory by default. That
directory is mail-group writable. Permissions on individual mailbox files may
differ:
- root mailbox is root:root 600
- user mailbox created by useradd is <user>:mail 660, hence mail group writable
- on RHEL4, mailbox file is created by useradd by default
- on RHEL5, mailbox file is not created by user add by default, but this may
change in future updates of shadow-utils package
(automatic mailbox creation can also be enabled by adding:
CREATE_MAIL_SPOOL=yes
to /etc/default/useradd file)
- user mailbox created by procmail / postfix /... is <user>:mail 600 by
default
If mail_extra_groups option is set to mail, IMAP users who also have shell
access can possibly read, modify or delete inbox files of other users, which are
stored in /var/mail .
Possible mitigations:
- do not set mail_extra_groups to mail
dovecot-1.0.13-6.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report. dovecot-1.0.13-18.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report. Giving this low, as this does not affect default or likely configuration and can easily be resolved by not setting mail as mail_extra_groups. This issue was resolved for dovecot packages shipped in Red Hat Enterprise Linux 5 in the following errata: https://rhn.redhat.com/errata/RHSA-2008-0297.html As mentioned above, this issue did not affect default configuration of any dovecot version as shipped in Red Hat Enterprise Linux 4 and 5, and Fedora. The risks associated with fixing this bug in dovecot packages in Red Hat Enterprise Linux 4 are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 4. |