Subject: UW-IMAP vulnerability?

From: Thiago Alves Siqueira <[email-masked]>
Date: Fri, 13 Feb 2004 15:03:15 -0200

Hi all!

I am implementing an Horde/IMP webmail on a server. It connects into my
IMAP server. If I log into the webmail and type in the address bar

https://webmail.yoursite.org/horde/imp/mailbox.php?mailbox=/etc/passwd

appears in my screen the file.

I asked about it in the HORDE mail list, and they said that it isn't his
program's vulnerability, but an IMAP's vulnerability. Is this true? Is
there a patch for this vulnerability, if it is really one?

I'm using debian and installed IMAP via apt-get.

Thanks,
- --
Thiago Alves Siqueira
ACME! Computer Security Researcher
[email-masked] - Brazil

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Fri, 13 Feb 2004 09:52:40 -0800 (PST)

By default, UW imapd allows access to any file that the logged in userid 
has access.  If this is a "vulnerability" in IMAP, then it is a 
vulnerability in the shell, in FTP, in scp, in NFS, and in anything else 
that allows file access.

If you wish to restrict user access to certain spaces, take a look at the 
restrictBox settings in imap-????/src/osdep/unix/env_unix.c.  restrictBox 
is a bitmask which can be set to RESTRICTROOT (to deny access to rooted 
names) and/or RESTRICTOTHERUSER (to deny access to "~").  If you set 
RESTRICTOTHERUSER you probably want to set RESTRICTROOT as well.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.