Subject: Fwd: Error Condition Re: Re: imap 2002a

From: Harrie Hazewinkel <[email-masked]>
Date: Fri, 6 Dec 2002 10:37:24 +0100

Hi,

On Friday, December 6, 2002, at 02:03 AM, Mark Crispin wrote:

> On Thu, 5 Dec 2002, Tomki wrote:
> On the ftp site, I see that the archive imap-2002 is no longer in
> place,
> but the development archive is.
> Does this indicate such a problem with imap-2002 that the dev version
> should be used instead?
>
> Yes.  A problem has been discovered

Does this mean the security whole (OK, you, Mark, don't think so)
is fixed??
Just that you know, I even set a login-shell for a user on
/usr/bin/false in order to disallow the user to login. Then connecting
via uw-imap/imapd I can almost select any file the user could see if
he could login, except those that do not get recognized as some mailbox
format.
This breaks the concept of IMAP does not have to disallow access to files
which a user could have retrieved otherwise. For instance, the user who
cannot login can never see the /etc/passwd-file, but via IMAP the user
can with the default configuration.

If that gets fixed would be great.

Harrie
------------------------------------------------------------------
Author of MOD-SNMP, enabling SNMP management of Apache HTTP server