courier: CVE-2021-38084

Debian Bug report logs - #989375
courier: CVE-2021-38084

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Sysadmin HTL Leonding <debbtsreports@htl-leonding.ac.at>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: courier-pop: CVE-2011-0411 equivalent vulnerability - fix not implemented

Date: Wed, 02 Jun 2021 08:59:02 +0200

Package: courier-pop
Severity: important

Dear Maintainer,

Uni Münster did a vulnerability scan on the Internet and reported a Debian server running 
courier-pop to be vulnerable to the equivalent of CVE-2011-0411. The system information
is from another system, but the issue exists in the upstream source, so it doesn't matter.

The suggested fixes from
www.postfix.org/CVE-2011-0411.html
have never been implemented in courier-pop (according to the researchers only in the IMAP
implementation).

There has been a very old bug report for Ubuntu (Debian security team asked me to open a ticket
in Debian BTS for this):
https://bugs.launchpad.net/ubuntu/+source/courier/+bug/1194892

In the meanwhile I got the information from a courier developer that while courier-pop 
is vulnerable to the same issue as the other programs (where fixes have been implemented)
according to him there has never been an practically exploit given the limitations of the 
POP3 protocol. The only possibility for an attacker would be to cause the server to send back
errors or failures to the login request and as the attacker is already MITM he/she could do 
that anyway.

As a measure of defense in depth and to prevent Internet scans to cause "noise", it might
be still a good idea to implement the suggested fixes in the POP3 implementation too.

Or someone could declare STARTTLS as anyway broken (then it should be disabled in config
and documented there) and users should use the TLS-only ports as researchers recommended
as workaround.


-- System Information:
Debian Release: 10.9
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-16-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages courier-pop depends on:
pn  courier-authlib                     <none>
pn  courier-base                        <none>
ii  debconf [debconf-2.0]               1.5.71
pn  default-mta | mail-transport-agent  <none>
ii  libc6                               2.28-10
pn  libcourier-unicode4                 <none>
ii  libidn11                            1.33-2.2
ii  sysvinit-utils                      2.93-8

courier-pop recommends no packages.

Versions of packages courier-pop suggests:
pn  courier-doc  <none>
pn  mail-reader  <none>

Message #12 received at 989375@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Sysadmin HTL Leonding <debbtsreports@htl-leonding.ac.at>, 989375@bugs.debian.org

Subject: Re: Bug#989375: courier-pop: CVE-2011-0411 equivalent vulnerability - fix not implemented

Date: Wed, 4 Aug 2021 20:04:06 +0200

Control: reassign -1 src:courier 1.0.16-3
Control: retitle -1 courier: CVE-2021-38084
Control: found -1 1.0.6-1

Hi,

On Wed, Jun 02, 2021 at 08:59:02AM +0200, Sysadmin HTL Leonding wrote:
> Package: courier-pop
> Severity: important
> 
> Dear Maintainer,
> 
> Uni Münster did a vulnerability scan on the Internet and reported a Debian server running 
> courier-pop to be vulnerable to the equivalent of CVE-2011-0411. The system information
> is from another system, but the issue exists in the upstream source, so it doesn't matter.
> 
> The suggested fixes from
> www.postfix.org/CVE-2011-0411.html
> have never been implemented in courier-pop (according to the researchers only in the IMAP
> implementation).
> 
> There has been a very old bug report for Ubuntu (Debian security team asked me to open a ticket
> in Debian BTS for this):
> https://bugs.launchpad.net/ubuntu/+source/courier/+bug/1194892
> 
> In the meanwhile I got the information from a courier developer that while courier-pop 
> is vulnerable to the same issue as the other programs (where fixes have been implemented)
> according to him there has never been an practically exploit given the limitations of the 
> POP3 protocol. The only possibility for an attacker would be to cause the server to send back
> errors or failures to the login request and as the attacker is already MITM he/she could do 
> that anyway.
> 
> As a measure of defense in depth and to prevent Internet scans to cause "noise", it might
> be still a good idea to implement the suggested fixes in the POP3 implementation too.
> 
> Or someone could declare STARTTLS as anyway broken (then it should be disabled in config
> and documented there) and users should use the TLS-only ports as researchers recommended
> as workaround.

This has now a own CVE, CVE-2021-38084. Fixed upstream in 1.1.5
according to
https://sourceforge.net/p/courier/mailman/message/37329216/ .

Regards,
Salvatore

Send a report that this bug log contains spam.