Bug Tracker item #2932993, was opened at 2010-01-15 18:34 Message generated for change (Comment added) made by ensc You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=1126467&aid=2932993&group_id=250683
Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: daemon Group: v3.9.0 Status: Open Resolution: None Priority: 9 Private: No Submitted By: Enrico Scholz (ensc) Assigned to: Stevan Bajic (sbajic) Summary: Path traversal vulnerability Initial Comment: $ dspamc --classify --user ../../../../../../etc -- < /tmp/sp # strace -f `pidof dspamd` stat64("/var/lib/dspam/data/././../../../../../..", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 ... # ll / -rw-rw---- 1 root mail 1573112 15. Jan 18:24 etc.css -rw-rw---- 1 root mail 0 15. Jan 18:24 etc.lock -rw-rw---- 1 root mail 12 15. Jan 18:24 etc.stats ------- 'dspam' should do some sanity checks regarding the username. Trusting e.g. into the MTA that only valid usernames are submitted does not suffice because there are dozens of ways how 'dspam' can be invoked and they can not be verified all. Measure like non-root execution of 'dspamd' can lower the impact of this attack but I would not trust on it either. ---------------------------------------------------------------------- >Comment By: Enrico Scholz (ensc) Date: 2010-01-20 10:01 Message: >> btw... "../" is a valid local-part accordingly rfc 5321 >> > Where in RFC 5321 is it written that "../" is a valid local-part? ok; you are right. But why are you checking for '../' and '..\' but not for '..' in your patch? >> problem still exists > >For the "--user" switch I would be surprised if it sill exists. afais, the '--user' switch is never used. The dspam daemon receives the RCPT TO value and processes it without calling an additional program. # strace -eexecve,stat64,recv -f -p 24353 [pid 31193] recv(4, "LHLO mail-filter\r\n", 1023, 0) = 18 ... [pid 31193] recv(4, "RCPT TO: <../../../../../../etc>", 1023, 0) = 32 ... [pid 31193] stat64("/var/lib/dspam/data/././../../../../../../etc", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 --- no execve()... ---------------------------------------------------------------------- Comment By: Stevan Bajic (sbajic) Date: 2010-01-20 02:26 Message: > btw... "../" is a valid local-part accordingly rfc 5321 > Where in RFC 5321 is it written that "../" is a valid local-part? As far as I know RFC 5322 is saying that a dot is a valid character in the local-part but not if it is the first character of the local-part and it is not valid if the dot appears two or more times consecutively. Could you point me to the section of RFC 5321 that is explicitly stating that ".." is a valid local-part? > problem still exists > For the "--user" switch I would be surprised if it sill exists. For the recipient passed by the DSPAM agent I don't say anything since I have not touched that but the "--user" switch should not allow "../" or "..\". ---------------------------------------------------------------------- Comment By: Enrico Scholz (ensc) Date: 2010-01-19 15:05 Message: problem still exists did you perhaps patched the wrong branch (flag_u instead of flag_r)? btw... "../" is a valid local-part accordingly rfc 5321 ---------------------------------------------------------------------- Comment By: Stevan Bajic (sbajic) Date: 2010-01-19 13:38 Message: Hallo Enrico any news regarding the attached patch? -- Kind Regards from Switzerland, Stevan Bajić ---------------------------------------------------------------------- Comment By: Stevan Bajic (sbajic) Date: 2010-01-18 16:26 Message: Hallo Enrico Scholz Could you try the attached patch? -- Kind Regards from Switzerland, Stevan Bajić ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=1126467&aid=2932993&group_id=250683 ------------------------------------------------------------------------------ Throughout its 18-year history, RSA Conference consistently attracts the world's best and brightest in the field, creating opportunities for Conference attendees to learn about information security's most important issues through interactions with peers, luminaries and emerging and established companies. http://p.sf.net/sfu/rsaconf-dev2dev _______________________________________________ Dspam-devel mailing list Dspam-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/dspam-devel