Your message dated Sat, 29 Oct 2005 01:35:05 +0200
with message-id <[EMAIL PROTECTED]>
and subject line Let version tracking deal with it
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 26 Aug 2005 10:33:30 +0000
>From [EMAIL PROTECTED] Fri Aug 26 03:33:30 2005
Return-path: <[EMAIL PROTECTED]>
Received: from mx01.hinterhof.net [83.137.99.114]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1E8bWc-0006bT-00; Fri, 26 Aug 2005 03:33:30 -0700
Received: from localhost (localhost [127.0.0.1])
by mx01.hinterhof.net (Postfix) with ESMTP id E98BF11041
for <[EMAIL PROTECTED]>; Fri, 26 Aug 2005 12:36:51 +0200 (CEST)
Received: from dp.roam.hinterhof.net (p54A7A5C9.dip0.t-ipconnect.de
[84.167.165.201])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "dp.roam.hinterhof.net", Issuer "hinterhofCA" (verified OK))
by mx01.hinterhof.net (Postfix) with ESMTP id B3EB010A31
for <[EMAIL PROTECTED]>; Fri, 26 Aug 2005 12:36:49 +0200 (CEST)
Received: by dp.roam.hinterhof.net (Postfix, from userid 1000)
id 1C202266E9E; Fri, 26 Aug 2005 12:34:20 +0200 (CEST)
Date: Fri, 26 Aug 2005 12:34:20 +0200
From: Max Vozeler <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: maildrop: lockmail doesn't drop privileges
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="zhXaljGHf11kAtnf"
Content-Disposition: inline
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
--zhXaljGHf11kAtnf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Package: maildrop
Version: 1.5.3-1.1
Severity: critical
Justification: local privilege escalation
Tags: security sarge sid patch
Hi Josip,
I've already tried to contact you about this, but have not heard
from you. I'm filing it now to keep track. Please refer to message
<[EMAIL PROTECTED]> for full details.
Short description:
lockmail.maildrop (setgid mail) lets the user specify a program and
execvp()s it, but does not drop egid mail privilege before doing so.
This opens a trivial privilege escalation (see "poc") to group mail.
The bug affects 1.5.3-1.1 sarge/etch/sid and 1.8.1-2 in experimental,
and should be easy to fix: Just add setgid(getgid()) before the
execvp(). I tested the attached patch briefly and verified that it
builds and prevents this bug.
The bug appears to be specific to Debian, upstream doesn't
seem to install lockmail with a setgid flag.
cheers,
Max
--zhXaljGHf11kAtnf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline; filename=poc
$ id
uid=1000(user) gid=1000(user) groups=1000(user)
$ lockmail.maildrop foo /bin/sh
$ id
uid=1000(user) gid=1000(user) egid=8(mail) groups=1000(user)
--zhXaljGHf11kAtnf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline; filename="lockmail_setgid.diff"
--- liblock/lockmail.c~ 2005-06-01 21:43:06.273749472 +0200
+++ liblock/lockmail.c 2005-06-01 21:32:04.000000000 +0200
@@ -160,6 +160,8 @@
if (pid == 0)
{
+ setgid(getgid());
+
(void)caught();
execvp(argvec[0], argvec);
--zhXaljGHf11kAtnf--
---------------------------------------
Received: (at 325135-done) by bugs.debian.org; 28 Oct 2005 23:35:09 +0000
>From [EMAIL PROTECTED] Fri Oct 28 16:35:09 2005
Return-path: <[EMAIL PROTECTED]>
Received: from higgs.djpig.de [213.133.98.126]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1EVdkb-0005Uk-00; Fri, 28 Oct 2005 16:35:09 -0700
Received: from djpig by higgs.djpig.de with local (Exim 4.50)
id 1EVdkX-0005nE-Ei
for [EMAIL PROTECTED]; Sat, 29 Oct 2005 01:35:05 +0200
Date: Sat, 29 Oct 2005 01:35:05 +0200
From: Frank Lichtenheld <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Let version tracking deal with it
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.9i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no
version=2.60-bugs.debian.org_2005_01_02
Version: 1.5.3-2
The version tracking of the BTS should note that this bug is
experimental only, this should not handled by tags anymore.
Gruesse,
--
Frank Lichtenheld <[EMAIL PROTECTED]>
www: http://www.djpig.de/
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
