bugweb-cyradm - Bugs: bug #15209, It's possible to have an alias and...


bug #15209: It's possible to have an alias and an email-address with the same name

Submitted by:  None
Submitted on:  Thu 15 Dec 2005 10:28:13 AM UTC  
Category:  None Severity:  3 - Normal
Priority:  7 - High Item Group:  security
Status:  Confirmed Privacy:  Public
Assigned to:  None Originator Name:  Roman Hochuli
Originator Email:  -email is unavailable- Open/Closed:  Open
Release:  0.5.4 Operating System:  None
Reproducibility:  Every Time Planned Release:  None
Cyrus IMAP version:  2.2.x PHP version:  4.3
Database type:  MySQL 4.0

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


( Jump to the original submission)

Sun 30 Jul 2006 08:11:44 PM UTC, comment #7: 

I added checks in editemail.php and newemail.php.

When you create new alias for some domain you can put only address from this domain. So you can't create cross-domain alias. For me that's enought. If two admins have access to one domain, they can easly check if aliases exists.
We can add extra information on accounts list that alias(forward) is active.
The same thing you can do with forwardaccount function.

Lukasz Marciniak <landm>
Project Member
Thu 16 Feb 2006 09:20:16 AM UTC, comment #6: 

If more than one admin has access to web-cyradm he coul create an alias with the same name of the other admin and the dest to the for  the new alias is the address of the second one.
Mails would be delivered to both ...
"Could" be a risk, IMHO it's just a failure in the design of web-cyradm.

Michael Muenz <mimu>
Project Member
Wed 15 Feb 2006 03:28:45 PM UTC, comment #5: 

I think this is not a bug. I use this very offen, when I already have an account and want (i.e. temporary) to send copy of emails to some other account. Why this is a security risk?

Lukasz Marciniak <landm>
Project Member
Mon 30 Jan 2006 01:52:15 PM UTC, comment #4: 

When you create an alias for domain newdomain.org, called alias@ and you also have an account with the address alias@, this account is automatically included within this alias (and not deletable).

So editalias.php is not affected!

But we need more check in editemail.php and newemail.php.
This should be fixed before 0.5.5.

Michael Muenz <mimu>
Project Member
Sat 17 Dec 2005 02:15:14 PM UTC, comment #3: 

updated the patch to fix a minor error because of a missing variable initialisation.

Roman Hochuli <medea61>
Sat 17 Dec 2005 01:42:08 PM UTC, comment #2: 

oh, btw: the patch is against the cvs version. :)

Roman Hochuli <medea61>
Sat 17 Dec 2005 01:38:01 PM UTC, comment #1: 

Since I have got some funded hours I've wrote a patch for this issue which I'd like to contribute. Probably there will be some more patches from me in the next days.

Roman Hochuli <medea61>
Thu 15 Dec 2005 10:28:13 AM UTC, original submission:  

It seems while creating an email-address is not checked if there is alread an alias with the same name. This results in the situation that there is an alias and an email-address with the same name.

If now somebody sends an email to that address the alias-recipients  as well as the account with that email-address receives that mail.

This raises quite some security questions...



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #2422:  anti-alias.patch added by medea61 (1KiB - application/octet-stream)
file #2420:  anti-alias.patch added by medea61 (1KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.




Follow 7 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-01-30 mimu Priority5 - Normal => 7 - High
    StatusNone => Confirmed
2005-12-17 medea61 Attached File- => Added anti-alias.patch, #3195
2005-12-17 medea61 Carbon-CopyRemoved -email is unavailable- => -
2005-12-17 medea61 Attached File- => Added anti-alias.patch, #3193
    Carbon-Copy- => Added medea61
2005-12-15 None Carbon-Copy- => Added roman --DOT-- hochuli --AT-- nexellent --DOT-- ch

Back to the top

Powered by Savane 3.5