full-disclosure - Re: IMAP4rev1 2000.283 allows access to system files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: listuser at seifried.org (Kurt Seifried)
Subject: Re: IMAP4rev1 2000.283 allows access to system files

Uh. This is EXPECTED behaviour, as in "yes, we know about it, it's designed
to do this, and has been doing this since the dawn of time". If you do not
like it you can:

a) chroot the users to their home dir, which is a REAL pain in the ass if
their mail spool is in /var/spool/mail or something similar, you will also
need to copy various library files/etc in.
b) use a different imap server such as cyrus which uses an internal mail
store

Kurt Seifried, kurt@...fried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/