full-disclosure - Local root compromise possible with getmail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200409191532.38997.baikie@ehwhat.freeserve.co.uk>
From: baikie at ehwhat.freeserve.co.uk (David Watson)
Subject: Local root compromise possible with getmail

The following vulnerabilities apply to all releases of getmail prior to 3.2.5, 
and all version 4 releases prior to 4.2.0. They do not apply where getmail is 
run as an unprivileged user, or where an unprivileged external MDA is used 
for the final delivery of mail. They are not exploitable remotely.

Although it is not the recommended mode of operation, by being run as root, 
getmail is able give users ownership of the files containing their new mail. 
However, the built-in mail delivery code was not suitable for use as root in 
the presence of hostile local users. It had the following vulnerabilities:

Mbox delivery (version 4 releases prior to 4.2.0):

Attacker replacing an mbox file with a symbolic link can have mail delivered 
(as root) into a new mbox file with a name and path of their choosing. 
Successful exploitation of a race condition allows existing files to be 
overwritten. The files are given 600 permissions and the same owner/group
as the directory containing the mbox delivery point.

Maildir delivery (version 4 releases prior to 4.2.0, all releases prior to 
3.2.5):

Attacker replacing subdirectories of a maildir with suitable symbolic links 
can have mail delivered into an arbitrary directory. Filenames cannot be 
chosen by the attacker, but successful exploitation of a race condition can 
allow arbitrary file contents to be substituted for mail. The files are given 
600 permissions and the same owner/group as the maildir.

Both sets of vulnerabilities may be exploited to have arbitrary commands 
executed as root.

Workaround:

Do not run getmail as a privileged user; or, in version 4, use an external MDA 
with explicitly configured user and group privileges.

Fix:

Versions 3.2.5 and 4.2.0 are now available at:

http://www.qcc.ca/~charlesc/software/getmail-4/

Version 3.2.5 just enforces the workaround. Version 4.2.0 solves the problem 
by dropping privileges to those of an explicitly configured user before 
delivering mail, as was already done for delivery by external MDAs.

Note: version 4 releases require Python 2.3.3 or later. Python 2.3.x can be 
installed alongside an earlier version if required; see the README file in 
the latest source tarball, available at http://www.python.org. Once 
installed, getmail will use whichever version was initially used to run its 
setup script.