Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 248840 (CVE-2008-5301) - net-mail/dovecot <1.1.7-r1 managesieve .sieve directory traversal (CVE-2008-5301)
Summary: net-mail/dovecot <1.1.7-r1 managesieve .sieve directory traversal (CVE-2008-5...
Status: RESOLVED FIXED
Alias: CVE-2008-5301
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://www.dovecot.org/list/dovecot/2...
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2008-11-26 00:51 UTC by Andrew Roberts
Modified: 2009-09-28 20:51 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Roberts 2008-11-26 00:51:06 UTC 
net-mail/dovecot-* with USE="managesieve"

In certain configurations, any user with can view or edit any *.sieve file that has file system permissions that allow this.  This is common in virtual user configurations.

All versions of dovecot presently in portage have this bug when USE=managesieve.  dovecot-1.1.7.ebuild contains the lines: MANAGESIEVE_PATCH="managesieve-0.10.4"
MANAGESIEVE="managesieve-0.10.3"
Besides it being a really bad idea to mix managesieve and managesive_patch versions managesieve-0.10.3 has still has the bug.  Suggest something like:

MANAGESIEVE="managesieve-0.10.4"
MANAGESIEVE_PATCH="$MANAGESIEVE"

Reproducible: Always

Steps to Reproduce:
Comment 1 Andrew Roberts 2008-11-26 02:07:45 UTC 
'../' is not filtered from script path.  See this post to dovecot mailing list: http://www.dovecot.org/list/dovecot/2008-November/035259.html
Comment 2 Wolfram Schlich (RETIRED) gentoo-dev 2008-11-29 20:36:13 UTC 
Fixed in 1.1.7-r1.
Comment 3 Stefan Behte (RETIRED) gentoo-dev Security 2008-12-02 11:26:16 UTC 
CVE-2008-5301 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5301):
  Directory traversal vulnerability in the ManageSieve implementation
  in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and
  modify arbitrary .sieve files via a ".." (dot dot) in a script name.
Comment 4 Robert Buchholz (RETIRED) gentoo-dev 2008-12-18 11:52:46 UTC 
GLSA 200812-16 covers this version as vulnerable, but we missed this bug in the GLSA processing. So I'll just go ahead and close [noglsa].