Your message dated Mon, 29 Aug 2005 11:17:03 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#325135: fixed in maildrop 1.5.3-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 26 Aug 2005 10:33:30 +0000
>From [EMAIL PROTECTED] Fri Aug 26 03:33:30 2005
Return-path: <[EMAIL PROTECTED]>
Received: from mx01.hinterhof.net [83.137.99.114]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1E8bWc-0006bT-00; Fri, 26 Aug 2005 03:33:30 -0700
Received: from localhost (localhost [127.0.0.1])
by mx01.hinterhof.net (Postfix) with ESMTP id E98BF11041
for <[EMAIL PROTECTED]>; Fri, 26 Aug 2005 12:36:51 +0200 (CEST)
Received: from dp.roam.hinterhof.net (p54A7A5C9.dip0.t-ipconnect.de
[84.167.165.201])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "dp.roam.hinterhof.net", Issuer "hinterhofCA" (verified OK))
by mx01.hinterhof.net (Postfix) with ESMTP id B3EB010A31
for <[EMAIL PROTECTED]>; Fri, 26 Aug 2005 12:36:49 +0200 (CEST)
Received: by dp.roam.hinterhof.net (Postfix, from userid 1000)
id 1C202266E9E; Fri, 26 Aug 2005 12:34:20 +0200 (CEST)
Date: Fri, 26 Aug 2005 12:34:20 +0200
From: Max Vozeler <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: maildrop: lockmail doesn't drop privileges
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="zhXaljGHf11kAtnf"
Content-Disposition: inline
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
--zhXaljGHf11kAtnf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Package: maildrop
Version: 1.5.3-1.1
Severity: critical
Justification: local privilege escalation
Tags: security sarge sid patch
Hi Josip,
I've already tried to contact you about this, but have not heard
from you. I'm filing it now to keep track. Please refer to message
<[EMAIL PROTECTED]> for full details.
Short description:
lockmail.maildrop (setgid mail) lets the user specify a program and
execvp()s it, but does not drop egid mail privilege before doing so.
This opens a trivial privilege escalation (see "poc") to group mail.
The bug affects 1.5.3-1.1 sarge/etch/sid and 1.8.1-2 in experimental,
and should be easy to fix: Just add setgid(getgid()) before the
execvp(). I tested the attached patch briefly and verified that it
builds and prevents this bug.
The bug appears to be specific to Debian, upstream doesn't
seem to install lockmail with a setgid flag.
cheers,
Max
--zhXaljGHf11kAtnf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline; filename=poc
$ id
uid=1000(user) gid=1000(user) groups=1000(user)
$ lockmail.maildrop foo /bin/sh
$ id
uid=1000(user) gid=1000(user) egid=8(mail) groups=1000(user)
--zhXaljGHf11kAtnf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline; filename="lockmail_setgid.diff"
--- liblock/lockmail.c~ 2005-06-01 21:43:06.273749472 +0200
+++ liblock/lockmail.c 2005-06-01 21:32:04.000000000 +0200
@@ -160,6 +160,8 @@
if (pid == 0)
{
+ setgid(getgid());
+
(void)caught();
execvp(argvec[0], argvec);
--zhXaljGHf11kAtnf--
---------------------------------------
Received: (at 325135-close) by bugs.debian.org; 29 Aug 2005 18:19:05 +0000
>From [EMAIL PROTECTED] Mon Aug 29 11:19:05 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 3.36 1 (Debian))
id 1E9oBr-0001yn-00; Mon, 29 Aug 2005 11:17:03 -0700
From: Andres Salomon <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.56 $
Subject: Bug#325135: fixed in maildrop 1.5.3-2
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Mon, 29 Aug 2005 11:17:03 -0700
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-CrossAssassin-Score: 2
Source: maildrop
Source-Version: 1.5.3-2
We believe that the bug you reported is fixed in the latest version of
maildrop, which is due to be installed in the Debian FTP archive:
maildrop_1.5.3-2.diff.gz
to pool/main/m/maildrop/maildrop_1.5.3-2.diff.gz
maildrop_1.5.3-2.dsc
to pool/main/m/maildrop/maildrop_1.5.3-2.dsc
maildrop_1.5.3-2_i386.deb
to pool/main/m/maildrop/maildrop_1.5.3-2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andres Salomon <[EMAIL PROTECTED]> (supplier of updated maildrop package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Mon, 29 Aug 2005 12:52:46 -0400
Source: maildrop
Binary: maildrop
Architecture: source i386
Version: 1.5.3-2
Distribution: unstable
Urgency: high
Maintainer: Josip Rodin <[EMAIL PROTECTED]>
Changed-By: Andres Salomon <[EMAIL PROTECTED]>
Description:
maildrop - mail delivery agent with filtering abilities
Closes: 265399 325135
Changes:
maildrop (1.5.3-2) unstable; urgency=high
.
* Add myself as a co-maintainer.
* Ack NMU (closes: #265399).
* [SECURITY] Fix privilege escalation bug, whereby one can obtain access
to group "mail"; lockmail forgets to drop privs. Thanks to Max Vozeler
(CAN-2005-2655) (closes: #325135).
Files:
d2919d7e28bced545224fdcfa5b2134c 628 mail optional maildrop_1.5.3-2.dsc
abe712833b112c5e208a0da6ca644014 25006 mail optional maildrop_1.5.3-2.diff.gz
d57572d4fc10c59072ae4881ef9cdfa2 313742 mail optional maildrop_1.5.3-2_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFDE0mG78o9R9NraMQRAoGYAJ4+OS2MxbEmGOe8fYLIZAycd9kCZQCfUiMY
+acbHo3kTubxlo4xBUcaphs=
=Yl1w
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
