University Of Washington IMAP Arbitrary File Access Vulnerability
BID:4909
Info
University Of Washington IMAP Arbitrary File Access Vulnerability
| Bugtraq ID: | 4909 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 01 2002 12:00AM |
| Updated: | Jun 01 2002 12:00AM |
| Credit: | Vulnerability discovery credited to 3APA3A <[email protected]>. |
| Vulnerable: |
Washington University wu-imapd 2001.0 a |
| Not Vulnerable: | |
Discussion
University Of Washington IMAP Arbitrary File Access Vulnerability
uw-imap is an open source Internet Message Access Protocol daemon. It is distributed and maintained by the University of Washington, and available for most operating systems including Unix, Linux, and Microsoft Windows.
In configurations where users are not authorized shell access to a system, but have a valid account from which to download mail via IMAP, a user may be able to gain access to information on the server. The feature enabled by default that allows users to view files via the IMAP daemon could result in information leakage on systems that depend on users not being able to view files on the local system. It should be noted that this feature is not documented in the literature distributed with the software.
uw-imap is an open source Internet Message Access Protocol daemon. It is distributed and maintained by the University of Washington, and available for most operating systems including Unix, Linux, and Microsoft Windows.
In configurations where users are not authorized shell access to a system, but have a valid account from which to download mail via IMAP, a user may be able to gain access to information on the server. The feature enabled by default that allows users to view files via the IMAP daemon could result in information leakage on systems that depend on users not being able to view files on the local system. It should be noted that this feature is not documented in the literature distributed with the software.
Exploit / POC
University Of Washington IMAP Arbitrary File Access Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
University Of Washington IMAP Arbitrary File Access Vulnerability
Solution:
The University of Washington IMAP FAQ gives the following information to secure affected servers:
5.1 I see that the IMAP server allows access to arbitary files on the system, including /etc/passwd! How do I disable this?
You should not worry about this if your IMAP users are allowed shell access. The IMAP server does not permit any access that the user can not have via the shell.
If, and only if, you deny your IMAP users shell access, you may want to consider one of three choices. Note that these choices reduce IMAP functionality, and may have undesirable side effects. Each of these choices involves an edit to file src/osdep/unix/env_unix.c
The first (and recommended) choice is to set restrictBox as described in file CONFIG. This will disable access to the filesystem root, to other users' home directory, and to superior directory.
The second (and strongly NOT recommended) choice is to set closedBox as described in file CONFIG. This puts each IMAP session into a so-called "chroot jail", and thus setting this option is extremely dangerous; it can make your system much less secure and open to root compromise attacks. So do not use this option unless you are absolutely certain that you understand all the issues of a "chroot jail."
The third choice is to rewrite routine mailboxfile() to implement whatever mapping from mailbox name to filesystem name (and restrictions) that you wish. This is the most general choice. As a guide, you can see at the start of routine mailboxfile() what the restrictBox choice does.
---
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The University of Washington IMAP FAQ gives the following information to secure affected servers:
5.1 I see that the IMAP server allows access to arbitary files on the system, including /etc/passwd! How do I disable this?
You should not worry about this if your IMAP users are allowed shell access. The IMAP server does not permit any access that the user can not have via the shell.
If, and only if, you deny your IMAP users shell access, you may want to consider one of three choices. Note that these choices reduce IMAP functionality, and may have undesirable side effects. Each of these choices involves an edit to file src/osdep/unix/env_unix.c
The first (and recommended) choice is to set restrictBox as described in file CONFIG. This will disable access to the filesystem root, to other users' home directory, and to superior directory.
The second (and strongly NOT recommended) choice is to set closedBox as described in file CONFIG. This puts each IMAP session into a so-called "chroot jail", and thus setting this option is extremely dangerous; it can make your system much less secure and open to root compromise attacks. So do not use this option unless you are absolutely certain that you understand all the issues of a "chroot jail."
The third choice is to rewrite routine mailboxfile() to implement whatever mapping from mailbox name to filesystem name (and restrictions) that you wish. This is the most general choice. As a guide, you can see at the start of routine mailboxfile() what the restrictBox choice does.
---
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
University Of Washington IMAP Arbitrary File Access Vulnerability
References:
References:
- UW IMAP Server FAQ (University of Washington)