CVE-2008-4577/CVE-2008-4578: security problems with the ACL plugin

Debian Bug report logs - #502967
CVE-2008-4577/CVE-2008-4578: security problems with the ACL plugin

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2008-4577/CVE-2008-4578: security problems with the ACL plugin

Date: Tue, 21 Oct 2008 22:30:22 +1100

Package: dovecot-common
Severity: important
Tags: security

Hi,
the following CVE (Common Vulnerabilities & Exposures) ids were
published for dovecot.

CVE-2008-4577[0]:
| The ACL plugin in Dovecot before 1.1.4 treats negative access rights
| as if they are positive access rights, which allows attackers to
| bypass intended access restrictions.

CVE-2008-4578[1]:
| The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass
| intended access restrictions by using the "k" right to create
| unauthorized "parent/child/child" mailboxes.

The upstream announcement can be found here[2]. I don't think this warrants
a DSA for etch and for lenny it could be fixed via unstable migration.

If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.

Cheers
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4577
    http://security-tracker.debian.net/tracker/CVE-2008-4577
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4578
    http://security-tracker.debian.net/tracker/CVE-2008-4578
[2] http://www.dovecot.org/list/dovecot-news/2008-October/000085.html

Message #10 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: 502967@bugs.debian.org

Subject: Patch available in upstream VCS

Date: Sat, 25 Oct 2008 19:36:51 +0100

CVE-2008-4577 has been fixed in the 1.0 branch, but hasn't been released
yet:

http://hg.dovecot.org/dovecot-1.0/rev/2dc3a5678fe5

I'm building packages including this fix and the FTBFS fix (#498679);
let me know if it's okay to upload.

Dominic.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Message #15 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Dominic Hargreaves <dom@earth.li>, 502967@bugs.debian.org

Subject: Re: Bug#502967: Patch available in upstream VCS

Date: Sat, 1 Nov 2008 14:27:50 +0100

[Message part 1 (text/plain, inline)]

Hi Dominic,
* Dominic Hargreaves <dom@earth.li> [2008-10-26 02:51]:
> CVE-2008-4577 has been fixed in the 1.0 branch, but hasn't been released
> yet:
> 
> http://hg.dovecot.org/dovecot-1.0/rev/2dc3a5678fe5
> 
> I'm building packages including this fix and the FTBFS fix (#498679);
> let me know if it's okay to upload.

This looks ok. What about 
http://hg.dovecot.org/dovecot-1.1/rev/d2657188377b which 
fixes the other issue?

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #20 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Nico Golde <nion@debian.org>

Cc: 502967@bugs.debian.org, Timo Sirainen <tss@iki.fi>

Subject: Re: Bug#502967: Patch available in upstream VCS

Date: Sat, 1 Nov 2008 16:17:31 +0000

On Sat, Nov 01, 2008 at 02:27:50PM +0100, Nico Golde wrote:
> This looks ok. What about 
> http://hg.dovecot.org/dovecot-1.1/rev/d2657188377b which 
> fixes the other issue?

I wasn't quite so confident about applying that straight away; I did
intend to talk to upstream about its applicability to the 1.0 series but
never got around to it.

Timo, do you have any comments about whether the above changeset could
be applied easily to dovecot 1.0? I've already applied 
http://hg.dovecot.org/dovecot-1.0/rev/2dc3a5678fe5
for the Debian packages.

Cheers,
Dominic.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Message #25 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Timo Sirainen <tss@iki.fi>

To: Dominic Hargreaves <dom@earth.li>

Cc: Nico Golde <nion@debian.org>, 502967@bugs.debian.org

Subject: Re: Bug#502967: Patch available in upstream VCS

Date: Sat, 01 Nov 2008 18:26:15 +0200

[Message part 1 (text/plain, inline)]

On Sat, 2008-11-01 at 16:17 +0000, Dominic Hargreaves wrote:
> On Sat, Nov 01, 2008 at 02:27:50PM +0100, Nico Golde wrote:
> > This looks ok. What about 
> > http://hg.dovecot.org/dovecot-1.1/rev/d2657188377b which 
> > fixes the other issue?
> 
> I wasn't quite so confident about applying that straight away; I did
> intend to talk to upstream about its applicability to the 1.0 series but
> never got around to it.
> 
> Timo, do you have any comments about whether the above changeset could
> be applied easily to dovecot 1.0? I've already applied 
> http://hg.dovecot.org/dovecot-1.0/rev/2dc3a5678fe5
> for the Debian packages.

Other distros' people have also asked me about that, but I haven't
bothered even trying to see how difficult it would be to backport to
v1.0. Maybe see if it's already been done in suse/redhat :)

[signature.asc (application/pgp-signature, inline)]

Message #30 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Timo Sirainen <tss@iki.fi>

Cc: Dominic Hargreaves <dom@earth.li>, 502967@bugs.debian.org

Subject: Re: Bug#502967: Patch available in upstream VCS

Date: Sat, 1 Nov 2008 18:36:48 +0100

[Message part 1 (text/plain, inline)]

Hi Timo,
* Timo Sirainen <tss@iki.fi> [2008-11-01 18:30]:
> On Sat, 2008-11-01 at 16:17 +0000, Dominic Hargreaves wrote:
> > On Sat, Nov 01, 2008 at 02:27:50PM +0100, Nico Golde wrote:
> > > This looks ok. What about 
> > > http://hg.dovecot.org/dovecot-1.1/rev/d2657188377b which 
> > > fixes the other issue?
> > 
> > I wasn't quite so confident about applying that straight away; I did
> > intend to talk to upstream about its applicability to the 1.0 series but
> > never got around to it.
> > 
> > Timo, do you have any comments about whether the above changeset could
> > be applied easily to dovecot 1.0? I've already applied 
> > http://hg.dovecot.org/dovecot-1.0/rev/2dc3a5678fe5
> > for the Debian packages.
> 
> Other distros' people have also asked me about that, but I haven't
> bothered even trying to see how difficult it would be to backport to
> v1.0. Maybe see if it's already been done in suse/redhat :)

At least redhat is not going to release a security update 
with this patch as it is too intrusive :/

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #35 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Timo Sirainen <tss@iki.fi>

Cc: Dominic Hargreaves <dom@earth.li>, 502967@bugs.debian.org

Subject: Re: Bug#502967: Patch available in upstream VCS

Date: Sun, 16 Nov 2008 17:24:45 +0100

[Message part 1 (text/plain, inline)]

Hi,
any news on this issue? It would be nice to get this fixed 
for lenny.

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #40 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Nico Golde <nion@debian.org>

Cc: Timo Sirainen <tss@iki.fi>, 502967@bugs.debian.org

Subject: Re: Bug#502967: Patch available in upstream VCS

Date: Wed, 19 Nov 2008 17:32:24 +0000

On Sun, Nov 16, 2008 at 05:24:45PM +0100, Nico Golde wrote:
> Hi,
> any news on this issue? It would be nice to get this fixed 
> for lenny.

None from me - I'm not the maintainer and in any case don't have the
expertise to backport this fix, sorry.

I'm not sure what the solution to this is; it's rather unfortunate that
lenny contains what's now an old branch of code that probably won't be
maintained any more.

Might be worth asking on the dovecot list to see if anyone is able to
offer a backport?

Dominic.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Message #45 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Nico Golde <nion@debian.org>

Cc: 502967@bugs.debian.org

Subject: Re: Bug#502967: Patch available in upstream VCS

Date: Wed, 19 Nov 2008 17:55:13 +0000

On Wed, Nov 19, 2008 at 05:32:24PM +0000, Dominic Hargreaves wrote:

> I'm not sure what the solution to this is; it's rather unfortunate that
> lenny contains what's now an old branch of code that probably won't be
> maintained any more.
> 
> Might be worth asking on the dovecot list to see if anyone is able to
> offer a backport?

For completeness, Redhat decision on this:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-4578

"The risks associated with fixing this bug are greater than the low
severity security risk. We therefore currently have no plans to fix
this flaw in Red Hat Enterprise Linux 5."

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Message #50 received at 502967@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: 502967@bugs.debian.org

Subject: CVE-2008-4578

Date: Sat, 29 Nov 2008 11:15:47 +0100 (CET)

> For completeness, Redhat decision on this:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-4578
>
> "The risks associated with fixing this bug are greater than the low
> severity security risk. We therefore currently have no plans to fix
> this flaw in Red Hat Enterprise Linux 5."

I agree with them that the severity is so low that it doesn't justify the 
work to backport and test the patch. I will mark it as no-dsa for lenny in 
the security tracker.

Message #55 received at 502967-done@bugs.debian.org (full text, mbox, reply):

From: Fabio Tranchitella <fabio@tranchitella.it>

To: 502967-done@bugs.debian.org

Subject: Closing old bug reports

Date: Fri, 27 Feb 2009 17:04:31 +0100

Version: 1:1.1.9-1

This bug has been fixed in 1:1.1.9-1.

-- 
Fabio Tranchitella                         http://www.kobold.it
Free Software Developer and Consultant     http://www.tranchitella.it
_____________________________________________________________________
1024D/7F961564, fpr 5465 6E69 E559 6466 BF3D 9F01 2BF8 EE2B 7F96 1564

Send a report that this bug log contains spam.