bugweb-cyradm - Bugs: bug #15209, It's possible to have an alias and...


bug #15209: It's possible to have an alias and an email-address with the same name

Submitted by:  None
Submitted on:  Thu Dec 15 10:28:13 2005  
Category: NoneSeverity: 3 - Normal
Priority: 7 - HighItem Group: security
Status: ConfirmedPrivacy: Public
Assigned to: NoneOriginator Name: Roman Hochuli
Originator Email: -unavailable-Open/Closed: Open
Release: 0.5.4Operating System: None
Reproducibility: Every TimePlanned Release: None
Cyrus IMAP version: 2.2.xPHP version: 4.3
Database type: MySQL 4.0

Add a New Comment (Rich MarkupRich Markup):

You are not logged in

Please log in, so followups can be emailed to you.


(Jump to the original submission Jump to the original submission)

Sun Jul 30 20:11:44 2006, comment #7:

I added checks in editemail.php and newemail.php.

When you create new alias for some domain you can put only address from this domain. So you can't create cross-domain alias. For me that's enought. If two admins have access to one domain, they can easly check if aliases exists.
We can add extra information on accounts list that alias(forward) is active.
The same thing you can do with forwardaccount function.

Lukasz Marciniak <landm>
Project Member
Thu Feb 16 09:20:16 2006, comment #6:

If more than one admin has access to web-cyradm he coul create an alias with the same name of the other admin and the dest to the for the new alias is the address of the second one.
Mails would be delivered to both ...
"Could" be a risk, IMHO it's just a failure in the design of web-cyradm.

Michael Muenz <mimu>
Project Member
Wed Feb 15 15:28:45 2006, comment #5:

I think this is not a bug. I use this very offen, when I already have an account and want (i.e. temporary) to send copy of emails to some other account. Why this is a security risk?

Lukasz Marciniak <landm>
Project Member
Mon Jan 30 13:52:15 2006, comment #4:

When you create an alias for domain newdomain.org, called alias@ and you also have an account with the address alias@, this account is automatically included within this alias (and not deletable).

So editalias.php is not affected!

But we need more check in editemail.php and newemail.php.
This should be fixed before 0.5.5.

Michael Muenz <mimu>
Project Member
Sat Dec 17 14:15:14 2005, comment #3:

updated the patch to fix a minor error because of a missing variable initialisation.

Roman Hochuli <medea61>
Sat Dec 17 13:42:08 2005, comment #2:

oh, btw: the patch is against the cvs version. :)

Roman Hochuli <medea61>
Sat Dec 17 13:38:01 2005, comment #1:

Since I have got some funded hours I've wrote a patch for this issue which I'd like to contribute. Probably there will be some more patches from me in the next days.

Roman Hochuli <medea61>
Thu Dec 15 10:28:13 2005, original submission:

It seems while creating an email-address is not checked if there is alread an alias with the same name. This results in the situation that there is an alias and an email-address with the same name.

If now somebody sends an email to that address the alias-recipients as well as the account with that email-address receives that mail.

This raises quite some security questions...



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #2422:  anti-alias.patch added by medea61 (1kB - application/octet-stream)
file #2420:  anti-alias.patch added by medea61 (1kB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.


Please enter the title of George Orwell's famous dystopian book (it's a date):



Follow 7 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon Jan 30 13:52:15 2006mimuPriority5 - Normal=>7 - High
Sat Dec 17 14:15:14 2005medea61Attached File-=>Added anti-alias.patch, #3195
Sat Dec 17 13:38:16 2005medea61Carbon-CopyRemoved -unavailable-=>-
Sat Dec 17 13:38:01 2005medea61Attached File-=>Added anti-alias.patch, #3193
  Carbon-Copy-=>Added medea61
Thu Dec 15 10:28:13 2005NoneCarbon-Copy-=>Added roman --DOT-- hochuli --AT-- nexellent --DOT-- ch

Back to the top

Powered by Savane 3.1-cleanup1