CVE request: dovecot unauthorized login

[Jonathan Smith <smithj () freethemallocs com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

thanks in advance

        smithj

- -------- Original Message --------
Subject: [Dovecot-news] Security hole #6: Some passdbs allowed users
to log  in without a    valid password
Date: Sun, 09 Mar 2008 13:09:44 +0200
From: Timo Sirainen <tss () iki fi>
Reply-To: dovecot () dovecot org
To: Dovecot News List <dovecot-news () dovecot org>
CC: Dovecot Mailing List <dovecot () dovecot org>

This affects only blocking passdbs:

~ - MySQL
~ - PAM, passwd and shadow if blocking=yes

The underlying bug exists in all v1.0.x versions, but I couldn't figure
out a way to exploit it except with v1.0.11, v1.0.12 and v1.1.rc2.
Probably a good idea to upgrade in any case.

The main problem is that Dovecot's internal protocols use TAB character
as a delimiter, but passwords were sent unescaped through them. So
passwords containing TAB characters allowed to add new internal fields.
The main problem here is a new "skip_password_check" field added in
v1.0.11 to fix problems with master user logins. Specifying this field
allowed the user to skip the password check, as the name implies.

This has been fixed thoroughly in v1.0.13 and v1.1.rc3 to make sure
there are no more escaping problems with any fields, but it can be also
fixed with a less intrusive patch for v1.0:
http://hg.dovecot.org/dovecot-1.0/raw-rev/da2a9372e26e


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.8 (GNU/Linux)

iEYEARECAAYFAkfT3mMACgkQCG91qXPaRekffQCfcPE7qjToe47c1L3nm5G1RVzZ
TdQAoKcLV5Gad5pEb3nF6729eprEtdPY
=kt8p
-----END PGP SIGNATURE-----