Subject: re: 4.05 wierdness

From: John Berthels <[email-masked]>
Date: Thu, 1 Oct 1998 10:28:09 +0100 (BST)

> > The idea is to set the mail spool directory so that any user can create a
> > new file in it.  This is needed so that Pine can write its lock file.

Is there a DoS vulnerability with users creating pseudo lock-files in the
spool directory?

e.g. /usr/spool/mail/victim already exists and is mode 600, spool itself
is mode 1777.

Can user 'nasty' create /usr/spool/mail/victim.lock (or similar named
file) and leave it there, so that even though mail gets delivered, etc
pine will think the mailbox is locked?

Or is the locking not implented this way?

jb

-- 
John Berthels
Email: [email-masked]
X.400: /G=john/S=berthels/O=nexor/P=nexor/A=cwmail/C=gb/

---

From: Tawfik Daoud <[email-masked]>
Date: Thu, 1 Oct 1998 13:17:56 +0000 (WET)

> Is there a DoS vulnerability with users creating pseudo lock-files in the

The lock files are created in order to protect the INBOX files from
corruption. 

> Or is the locking not implented this way?

I guess the best explanation so far came from Tim DiLauro <[email-masked]>:

===== Start Quote =====
"The idea is to set the mail spool directory so that any user can create a
new file in it.  This is needed so that Pine can write its lock file.  And
mode 1777 does not mean world writeable, although it might look that way.
Mode 1777 means that any user can create/rename/delete (basically do
directory operations for) a file that is owned by that user.  You can't do
these things to other people's files.

Individuals mailboxes should have the protections that they need to work
with your mail system -- ideally they are mode 600 (read/write by the
owner only)."
===== End Quote =====

-Tawfik
_______________________________________
Tawfik H. Daoud
Cyber Mania - Internet Service Provider
68, Avenue Mohamed V,
93000 Tetouan, Morocco
Telephone: +212.9.704987
Fax: +212.9.965883
E-mail: [email-masked]
http://www.cybermania.net.ma

---

From: Ian Hall-Beyer <[email-masked]>
Date: Thu, 1 Oct 1998 07:38:28 -0600 (MDT)

> with your mail system -- ideally they are mode 600 (read/write by the

Indeed. However, for some strange reason, Pine on my machine also wants
exec permission on that folder. so 700 it is.

-Ian

---

From: John Berthels <[email-masked]>
Date: Thu, 1 Oct 1998 18:37:04 +0100 (BST)

>> Is there a DoS vulnerability with users creating pseudo lock-files in
>> the spool directory?
 
> The lock files are created in order to protect the INBOX files from

Sorry not to have made my question clear the first time:

If I (maliciously) create a lock file for another user's mailbox, will
PINE consider that users mailbox to be locked and so not allow that user
to receive mail?

i.e. Since the lock file for a user does not exist whilst they are not
reading their mail (is this correct?) I can create it (even taking mode
1777 into account). Next time they try to read their mail a lock file (my
bogus one) will exist. Will PINE permit them to read their mail under
these conditions?

[I'd try this here, but I get my mail via procmail, not out of the spool
dir - this is purely a theoretical interest.]

regards,

jb

---

From: Bobby Ezell <[email-masked]>
Date: Thu, 1 Oct 1998 14:39:29 -0700 (PDT)

I know this subject is getting over-talked about, but I did the experiment
and this is what I observed:
	1) yes, if no file exists yet, I can create a /var/spool/mail/test
           file, i.e. 
              cp /dev/null /var/spool/mail/test
	   result is
	      test -rw-r--r--   me   users
	
	3) pico test (and I can edit it and put "junk" in it"). At this
	   point if user test tries to access his/her mail box with pine
	   you get a message about invalid inbox format (or something like
	   that) and access is not allowed.

	4) I then send mail to test through pine and the mail box gets
	   cleared and a new one created with the imfamous not-visible 
	   "Do Not Remove..." message as the first one in the box, and
           then the message just sent. My "junk" goes away. Also
           permissions change to
 	      test -rw------    test  users

	5) user test can now read mail with pine...

It seems like sendmail (I am on LINUX) now takes care of it's mail folders
after the first good message sent. I have seen this happen with student
accounts at a local college where I use to work on Solaris and it seems to
hold on Linux too.

Of course the solution would be for the adduser script to build in a NEW
mail folder under /var/spool/mail/ with proper permissions set (as it
should have in this case but I commented those lines out).

Anyone else get different results?

> dir - this is purely a theoretical interest.]

-------------------------------------------------------------------
Bobby Ezell                           E-Mail:  [email-masked]      
Technical Sales Support               V-Mail:  503-624-0360 (voice)       
Rasmussen Software, Inc.              F-Mail:  503-624-0760 (fax)       
10240 SW Nimbus Ave., Ste L9          http://www.anzio.com 
Portland, OR 97223                    http://www.anzio.com/~bezell   
-------------------------------------------------------------------
        AnzioLite and AnzioWin for all your telnet needs
       Send sales & support questions to:   [email-masked]
===================================================================

---

From: Tawfik Daoud <[email-masked]>
Date: Thu, 1 Oct 1998 22:53:46 +0000 (WET)

> 	   that) and access is not allowed.

Of course you are not going to access the created TEST file because it is
corrupted (or in fact not in MIME format).

> should have in this case but I commented those lines out).

Actually, you do not have to create that file with proper permissions, 
since sendmail takes care of that. Let me illustrate this scenario when
sendmail receives an email:
1. First check if user exists if no then (2) else (3)
2. Case User does not exist: send a message informing both postmaster and 
   email FROM:
3. Case User exists: check whether there exists a file name "username" 
   in directory /var/spool/mail (or /usr/spool/mail or whatever) if yes
   then (4) otherwise (5)
4. Append message to file "username"
5. Create a file name called "username" mode 600 and add the received
   email
-Tawfik
_______________________________________
Tawfik H. Daoud
Cyber Mania - Internet Service Provider
68, Avenue Mohamed V,
93000 Tetouan, Morocco
Telephone: +212.9.704987
Fax: +212.9.965883
E-mail: [email-masked]
http://www.cybermania.net.ma