http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sig This is mainly to fix the 0777 base_dir creation issue, which could be considered a security hole, exploitable by local users. An attacker could for example replace Dovecot's auth socket and log in as other users. Gaining root privileges isn't possible though. This affects only v1.2 users, v1.1 and older versions were creating the directory with 0755 permission. If your Dovecot's base_dir isn't in /var/run/dovecot/, you should also make sure that the $prefix/var/ and $prefix/var/run/ (i.e. /usr/local/var/, /usr/local/var/run/ by default) aren't 0777. * Dovecot v1.2.x had been creating base_dir (and its parents if necessary) with 0777 permissions. The base_dir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually. - acl: If user has rights from more than one group, merge them instead of choosing one group's rights and ignoring others. - virtual: When using a lot of mailboxes, the virtual mailbox's header could have grown over 32 kB and caused "out of memory" crashes. Also over 64 kB headers couldn't even be updated with existing transaction log records. Added a new record type that gets used with >=64 kB headers. Older Dovecot versions don't understand this header and will log errors if they see it. - FETCH BODYSTRUCTURE didn't return RFC 2231 "key*" fields correctly -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 197 bytes Desc: This is a digitally signed message part Url : http://dovecot.org/pipermail/dovecot-news/attachments/20091119/d5f70546/attachment.bin
On November 19, 2009 7:45:05 PM -0500 Timo Sirainen <tss at iki.fi> wrote:> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz > http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sig > > This is mainly to fix the 0777 base_dir creation issue, which could be > considered a security hole, exploitable by local users. An attacker > could for example replace Dovecot's auth socket and log in as other > users. Gaining root privileges isn't possible though.Isn't it possible to login as a master user? -frank
On Thu, 19 Nov 2009, Timo Sirainen wrote:> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz > http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sigStephan we need you! ;-) -- Sahil Tandon <sahil at tandon.net>
On November 21, 2009 11:51:29 AM -0500 Sahil Tandon <sahil at tandon.net> wrote:> On Thu, 19 Nov 2009, Timo Sirainen wrote: > >> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz >> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sig > > Stephan we need you! ;-)I used the 1.2.7 patch which worked perfectly.
On Nov 21, 2009, at 1:07 PM, Frank Cusack <fcusack at fcusack.com> wrote:> On November 21, 2009 11:51:29 AM -0500 Sahil Tandon > <sahil at tandon.net> wrote: >> On Thu, 19 Nov 2009, Timo Sirainen wrote: >> >>> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz >>> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sig >> >> Stephan we need you! ;-) > > I used the 1.2.7 patch which worked perfectly.As did I. *sigh*. Packets of jest clearly get mangled via TCP.
Timo Sirainen wrote:> http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz > http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sig >I've updated the ManageSieve patch and fixed documentation issue reported by Frank Cusack: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.8-managesieve-0.11.9.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.8-managesieve-0.11.9.diff.gz.sig Regards, Stephan.