Your message dated Sat, 09 Sep 2006 14:33:29 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#325135: fixed in maildrop 2.0.2-7
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: maildrop
Version: 1.5.3-1.1
Severity: critical
Justification: local privilege escalation
Tags: security sarge sid patch
Hi Josip,
I've already tried to contact you about this, but have not heard
from you. I'm filing it now to keep track. Please refer to message
<[EMAIL PROTECTED]> for full details.
Short description:
lockmail.maildrop (setgid mail) lets the user specify a program and
execvp()s it, but does not drop egid mail privilege before doing so.
This opens a trivial privilege escalation (see "poc") to group mail.
The bug affects 1.5.3-1.1 sarge/etch/sid and 1.8.1-2 in experimental,
and should be easy to fix: Just add setgid(getgid()) before the
execvp(). I tested the attached patch briefly and verified that it
builds and prevents this bug.
The bug appears to be specific to Debian, upstream doesn't
seem to install lockmail with a setgid flag.
cheers,
Max
$ id
uid=1000(user) gid=1000(user) groups=1000(user)
$ lockmail.maildrop foo /bin/sh
$ id
uid=1000(user) gid=1000(user) egid=8(mail) groups=1000(user)
--- liblock/lockmail.c~ 2005-06-01 21:43:06.273749472 +0200
+++ liblock/lockmail.c 2005-06-01 21:32:04.000000000 +0200
@@ -160,6 +160,8 @@
if (pid == 0)
{
+ setgid(getgid());
+
(void)caught();
execvp(argvec[0], argvec);
--- End Message ---
--- Begin Message ---
Source: maildrop
Source-Version: 2.0.2-7
We believe that the bug you reported is fixed in the latest version of
maildrop, which is due to be installed in the Debian FTP archive:
maildrop_2.0.2-7.diff.gz
to pool/main/m/maildrop/maildrop_2.0.2-7.diff.gz
maildrop_2.0.2-7.dsc
to pool/main/m/maildrop/maildrop_2.0.2-7.dsc
maildrop_2.0.2-7_i386.deb
to pool/main/m/maildrop/maildrop_2.0.2-7_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Josip Rodin <[EMAIL PROTECTED]> (supplier of updated maildrop package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sat, 9 Sep 2006 00:18:03 +0200
Source: maildrop
Binary: maildrop
Architecture: source i386
Version: 2.0.2-7
Distribution: unstable
Urgency: low
Maintainer: Josip Rodin <[EMAIL PROTECTED]>
Changed-By: Josip Rodin <[EMAIL PROTECTED]>
Description:
maildrop - mail delivery agent with filtering abilities
Closes: 325135
Changes:
maildrop (2.0.2-7) unstable; urgency=low
.
* Added 006-maildirmake-error-clarifications.patch, which clarifies
two basic error messages in maildirmake.
* Added *back* the patch that fixes the privilege escalation in lockmail,
which was fixed on August 29, 2005, but reintroduced afterwards and
survived up to now. Damn. Thanks to Andreas Barth for noticing.
This finally closes: #325135.
Files:
d2bd1705e068d1a90e9005677c5e9181 673 mail optional maildrop_2.0.2-7.dsc
641b1cfc21b4bd3daa6abd4dc6ca98fe 12125 mail optional maildrop_2.0.2-7.diff.gz
ef477a67a296e28d44a4081e9fdbd35d 349614 mail optional maildrop_2.0.2-7_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFFAzHPC1RHoiANFZYRAhk3AJ4tYxJKGAhiZjOJy426qxFitBEsRQCfQ9e0
iBeb0OXhbiJEl8ByegzFO4c=
=9MTL
-----END PGP SIGNATURE-----
--- End Message ---
