bugweb-cyradm - Bugs: bug #15209, It's possible to have an alias and...


bug #15209: It's possible to have an alias and an email-address with the same name

Submitted by:  None
Submitted on:  Thu 15 Dec 2005 10:28:13 AM UTC  
Category: NoneSeverity: 3 - Normal
Priority: 7 - HighItem Group: security
Status: ConfirmedPrivacy: Public
Assigned to: NoneOriginator Name: Roman Hochuli
Originator Email: -unavailable-Open/Closed: Open
Release: 0.5.4Operating System: None
Reproducibility: Every TimePlanned Release: None
Cyrus IMAP version: 2.2.xPHP version: 4.3
Database type: MySQL 4.0

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


(Jump to the original submission Jump to the original submission)

Sun 30 Jul 2006 08:11:44 PM UTC, comment #7:

I added checks in editemail.php and newemail.php.

When you create new alias for some domain you can put only address from this domain. So you can't create cross-domain alias. For me that's enought. If two admins have access to one domain, they can easly check if aliases exists.
We can add extra information on accounts list that alias(forward) is active.
The same thing you can do with forwardaccount function.

Lukasz Marciniak <landm>
Project Member
Thu 16 Feb 2006 09:20:16 AM UTC, comment #6:

If more than one admin has access to web-cyradm he coul create an alias with the same name of the other admin and the dest to the for the new alias is the address of the second one.
Mails would be delivered to both ...
"Could" be a risk, IMHO it's just a failure in the design of web-cyradm.

Michael Muenz <mimu>
Project Member
Wed 15 Feb 2006 03:28:45 PM UTC, comment #5:

I think this is not a bug. I use this very offen, when I already have an account and want (i.e. temporary) to send copy of emails to some other account. Why this is a security risk?

Lukasz Marciniak <landm>
Project Member
Mon 30 Jan 2006 01:52:15 PM UTC, comment #4:

When you create an alias for domain newdomain.org, called alias@ and you also have an account with the address alias@, this account is automatically included within this alias (and not deletable).

So editalias.php is not affected!

But we need more check in editemail.php and newemail.php.
This should be fixed before 0.5.5.

Michael Muenz <mimu>
Project Member
Sat 17 Dec 2005 02:15:14 PM UTC, comment #3:

updated the patch to fix a minor error because of a missing variable initialisation.

Roman Hochuli <medea61>
Sat 17 Dec 2005 01:42:08 PM UTC, comment #2:

oh, btw: the patch is against the cvs version. :)

Roman Hochuli <medea61>
Sat 17 Dec 2005 01:38:01 PM UTC, comment #1:

Since I have got some funded hours I've wrote a patch for this issue which I'd like to contribute. Probably there will be some more patches from me in the next days.

Roman Hochuli <medea61>
Thu 15 Dec 2005 10:28:13 AM UTC, original submission:

It seems while creating an email-address is not checked if there is alread an alias with the same name. This results in the situation that there is an alias and an email-address with the same name.

If now somebody sends an email to that address the alias-recipients as well as the account with that email-address receives that mail.

This raises quite some security questions...



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #2422:  anti-alias.patch added by medea61 (1KiB - application/octet-stream)
file #2420:  anti-alias.patch added by medea61 (1KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.


Please enter the title of George Orwell's famous dystopian book (it's a date):



Follow 7 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 30 Jan 2006 01:52:15 PM UTCmimuPriority5 - Normal=>7 - High
Sat 17 Dec 2005 02:15:14 PM UTCmedea61Attached File-=>Added anti-alias.patch, #3195
Sat 17 Dec 2005 01:38:16 PM UTCmedea61Carbon-CopyRemoved -unavailable-=>-
Sat 17 Dec 2005 01:38:01 PM UTCmedea61Attached File-=>Added anti-alias.patch, #3193
  Carbon-Copy-=>Added medea61
Thu 15 Dec 2005 10:28:13 AM UTCNoneCarbon-Copy-=>Added roman --DOT-- hochuli --AT-- nexellent --DOT-- ch

Back to the top

Powered by Savane 3.1-cleanup1