Davide Libenzi wrote: > On Tue, 20 Nov 2007, Gerrit E.G. Hobbelt wrote: > > > Hi, > > > > While hunting down another issue (to be posted shortly), I ran into this > > one. Shouldn't the '&&' be replaced with a '||' for security reasons in > > error situations? Otherwise error situations in [ONLY] ONE of the calls > > (due to wrong setup or other gimmicks) would INCORRECTLY and UNDESIRABLY > > mark the client as authenticated. (i.e. a [minor/micro? ;-) ] security > > hole.) > > No, it is as designed. It needs to check *both* authentications. > Please stop spreading FUD about security holes. > Heard you loud & clear. I will.
The situation can occur when you've a flawed configuration, where smtpauth.tab contains a line for user U with a different password than the one encoded in mailusers.tab. Yep, a setup/config error. Which would pass unnoticed with '&&' but will reject the user when using '||'. In both situations both parts of the authentication are performed, but in the latter an error is reported and the user rejected while in the former the user is accepted. Of course, all this would never happen if the ctrl app is used consistently. That's all. Just someone being stupid some day. Sorry to waste your time again. - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED]
