Your message dated Thu, 06 Mar 2008 16:17:09 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#469457: fixed in dovecot 1:1.0.12-1
has caused the Debian Bug report #469457,
regarding dovecot-imapd: allows to read other users' mboxes in /var/mail
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
469457: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469457
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: dovecot-imapd
Severity: critical
Tags: security
Justification: root security hole
I believe all versions of Dovecot in Debian are concerned by this warning :
http://dovecot.org/list/dovecot/2008-March/029196.html
On fairly standard Debian installations (Etch & Lenny) with mail delivered in
/var/mail I was able to read other users' mboxes through a symlink in ~/Mail.
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (900, 'testing'), (900, 'stable'), (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.24-1-686 (SMP w/2 CPU cores)
Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash
Versions of packages dovecot-imapd depends on:
pn dovecot-common <none> (no description available)
ii libc6 2.7-6 GNU C Library: Shared libraries
ii libssl0.9.8 0.9.8g-4 SSL shared libraries
dovecot-imapd recommends no packages.
--- End Message ---
--- Begin Message ---
Source: dovecot
Source-Version: 1:1.0.12-1
We believe that the bug you reported is fixed in the latest version of
dovecot, which is due to be installed in the Debian FTP archive:
dovecot-common_1.0.12-1_amd64.deb
to pool/main/d/dovecot/dovecot-common_1.0.12-1_amd64.deb
dovecot-dev_1.0.12-1_amd64.deb
to pool/main/d/dovecot/dovecot-dev_1.0.12-1_amd64.deb
dovecot-imapd_1.0.12-1_amd64.deb
to pool/main/d/dovecot/dovecot-imapd_1.0.12-1_amd64.deb
dovecot-pop3d_1.0.12-1_amd64.deb
to pool/main/d/dovecot/dovecot-pop3d_1.0.12-1_amd64.deb
dovecot_1.0.12-1.diff.gz
to pool/main/d/dovecot/dovecot_1.0.12-1.diff.gz
dovecot_1.0.12-1.dsc
to pool/main/d/dovecot/dovecot_1.0.12-1.dsc
dovecot_1.0.12.orig.tar.gz
to pool/main/d/dovecot/dovecot_1.0.12.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Fabio Tranchitella <[EMAIL PROTECTED]> (supplier of updated dovecot package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Thu, 06 Mar 2008 15:53:07 +0100
Source: dovecot
Binary: dovecot-common dovecot-dev dovecot-imapd dovecot-pop3d
Architecture: source amd64
Version: 1:1.0.12-1
Distribution: unstable
Urgency: high
Maintainer: Dovecot Maintainers <[EMAIL PROTECTED]>
Changed-By: Fabio Tranchitella <[EMAIL PROTECTED]>
Description:
dovecot-common - secure mail server that supports mbox and maildir mailboxes
dovecot-dev - header files for the dovecot mail server
dovecot-imapd - secure IMAP server that supports mbox and maildir mailboxes
dovecot-pop3d - secure POP3 server that supports mbox and maildir mailboxes
Closes: 469457
Changes:
dovecot (1:1.0.12-1) unstable; urgency=high
.
* New upstream release. (Closes: #469457)
* debian/patches/dovecot-MANAGESIEVE-9.2.dpatch: updated, thanks to Marco
Nenciarini for the patch.
Files:
dd204cd4c2b78ad919bf4d372a434d69 1183 mail optional dovecot_1.0.12-1.dsc
a03779d3df13eadd0d3fa42802143e1e 1772998 mail optional
dovecot_1.0.12.orig.tar.gz
be1878be5ad16a86208fd036dea772ab 217616 mail optional dovecot_1.0.12-1.diff.gz
5214cacab83cfc270f6bc3cae1290289 2067270 mail optional
dovecot-common_1.0.12-1_amd64.deb
c713729bf56848b0fffa2c28213e91d4 386644 mail optional
dovecot-dev_1.0.12-1_amd64.deb
8a79346eb304eeea26f23cfabd7d2acd 659088 mail optional
dovecot-imapd_1.0.12-1_amd64.deb
73a4171b26df436107ae5691d93f1192 622006 mail optional
dovecot-pop3d_1.0.12-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFH0BKEK/juK3+WFWQRAmkmAJ0YEpRyZQpuZbGvnyxPuwBzWt5YzACdGxZk
Mu2uDAILAk/bOOmib155qCo=
=EyWR
-----END PGP SIGNATURE-----
--- End Message ---
