Yo Timo, did you say that login processes "just don't crash"? Found these while doing load/malformed data tests. Got the kernel patch allow_setid_cores working. Don't have time to check if they're exploitable. Probably time to get a gamma version out for people, eh?

Cheers, Jared :)

=========================================================================================== Note: Running dovecot-1.0.beta2 with simple (no funniness) config Note: Running on Intel (in VmWare) with RH9. Note: I'm using shadow authentication, but tried with PAM and it still dumped. Note: For this first core, I see the server responding with: "*OK Waiting for authentication process to respond.." Note: Not sure, but I think these problems are timing related. Be sure to check if a pointer is valid and that will get rid of most of these. Note: I have plenty of sample cores if you need one to fix. -Jared DeMott

[root@server dovecot]# gdb ./dovecot-auth -c core.22753 GNU gdb Red Hat Linux (5.3post-0.20021129.18rh) Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... Core was generated by `dovecot-auth'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libcrypt.so.1...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /lib/libpam.so.0...done. Loaded symbols for /lib/libpam.so.0 Reading symbols from /lib/libdl.so.2...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/tls/libc.so.6...done. Loaded symbols for /lib/tls/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 #0 auth_request_unref (_request=0x807b0f0) at auth-request.c:96 96 i_assert(request->refcount > 0); (gdb) bt #0 auth_request_unref (_request=0x807b0f0) at auth-request.c:96 #1 0x080523ee in auth_request_handler_unref (_handler=0x807b0f0) at auth-request-handler.c:66 #2 0x08050217 in auth_client_connection_destroy (_conn=0x807b0f0) at auth-client-connection.c:327 #3 0x0804ffd8 in auth_client_input (context=0x807b0f0) at auth-client-connection.c:227 #4 0x080607d0 in io_loop_handler_run (ioloop=0x8073100) at ioloop-poll.c:189 #5 0x0805fe29 in io_loop_run (ioloop=0x8073100) at ioloop.c:235 #6 0x08055329 in main (argc=1, argv=0xbfffe454) at main.c:309 #7 0x42015574 in __libc_start_main () from /lib/tls/libc.so.6 (gdb) p request $1 = (struct auth_request *) 0x1 (gdb) i r eax 0x807b0f0 134721776 ecx 0x1 1 edx 0x6c 108 ebx 0x8084e78 134762104 esp 0xbfffe2f0 0xbfffe2f0 ebp 0xbfffe2f8 0xbfffe2f8 esi 0x80a43c8 134890440 edi 0xbfffe314 -1073749228 eip 0x80512d1 0x80512d1 eflags 0x286 646 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x33 51 (gdb)

[root@server 1]# gdb ./dovecot-auth -c core.30100 GNU gdb Red Hat Linux (5.3post-0.20021129.18rh) Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"...

warning: exec file is newer than core file. Core was generated by `dovecot-auth'. Program terminated with signal 6, Aborted. #0 0xffffe002 in ?? () (gdb) bt #0 0xffffe002 in ?? () #1 0x42028a73 in ?? () #2 0x0805d47c in default_info_handler (format=0x8067d00 "\024P?u\024?u\020?u\f?u\b?\t", args=0xbffff264 "z|\006\b!") at failures.c:162 #3 0x0805d04b in t_buffer_alloc (size=1108544020) at data-stack.c:347 #4 0x0804fa54 in reply_line_hide_pass (line=0x1 <Address 0x1 out of bounds>) at auth-client-connection.c:35 #5 0x0804fa71 in reply_line_hide_pass (line=0x0) at auth-client-connection.c:36 #6 0x080523bb in auth_request_handler_unref (_handler=0x0) at auth-request-handler.c:74 #7 0x08052b65 in auth_request_handler_auth_continue (handler=0x0, args=0x80774e0 "HU\n\b") at auth-request-handler.c:350 #8 0x0805f916 in io_add (fd=2, condition=39, callback=0x80778e8, context=0x0) at ioloop.c:23 #9 0x080602c8 in io_loop_notify_remove (ioloop=0x0, io=0x8075b00) at ioloop-notify-dn.c:138 #10 0x0805f985 in io_add (fd=0, condition=1073792608, callback=0x80678bc <pwrite_full+64>, context=0x0) at ioloop.c:43 #11 0x08054f94 in add_extra_listeners () at main.c:148 #12 0x42015574 in ?? () (gdb) i r eax 0x0 0 ecx 0x6 6 edx 0x42130a14 1108544020 ebx 0x7594 30100 esp 0xbffff0e0 0xbffff0e0 ebp 0xbffff0e8 0xbffff0e8 esi 0x806daa8 134666920 edi 0x80e92e8 135172840 eip 0xffffe002 0xffffe002 eflags 0x246 582 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x33 51 (gdb)

[root@server login]# gdb ./imap-login -c core.25116 GNU gdb Red Hat Linux (5.3post-0.20021129.18rh) Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... Core was generated by `imap-login'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libssl.so.4...done. Loaded symbols for /lib/libssl.so.4 Reading symbols from /lib/libcrypto.so.4...done. Loaded symbols for /lib/libcrypto.so.4 Reading symbols from /lib/libresolv.so.2...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /usr/kerberos/lib/libgssapi_krb5.so.2...done. Loaded symbols for /usr/kerberos/lib/libgssapi_krb5.so.2 Reading symbols from /usr/kerberos/lib/libkrb5.so.3...done. Loaded symbols for /usr/kerberos/lib/libkrb5.so.3 Reading symbols from /usr/kerberos/lib/libk5crypto.so.3...done. Loaded symbols for /usr/kerberos/lib/libk5crypto.so.3 Reading symbols from /usr/kerberos/lib/libcom_err.so.3...done. Loaded symbols for /usr/kerberos/lib/libcom_err.so.3 Reading symbols from /lib/libdl.so.2...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /usr/lib/libz.so.1...done. Loaded symbols for /usr/lib/libz.so.1 Reading symbols from /lib/tls/libc.so.6...done. Loaded symbols for /lib/tls/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 #0 i_stream_read (stream=0x0) at istream.c:48 48 if (stream->closed) (gdb) bt #0 i_stream_read (stream=0x0) at istream.c:48 #1 0x0804ade2 in client_read (client=0x8070410) at client.c:311 #2 0x0804ae3c in client_input (context=0x8070410) at client.c:333 #3 0x08055558 in io_loop_handler_run (ioloop=0x806cc50) at ioloop-poll.c:189 #4 0x08054bb1 in io_loop_run (ioloop=0x806cc50) at ioloop.c:235 #5 0x0804d3ed in main (argc=1, argv=0xbffff504, envp=0xbffff50c) at main.c:341 #6 0x42015574 in __libc_start_main () from /lib/tls/libc.so.6 (gdb) p stream $1 = (struct istream *) 0x0 (gdb)

[root@server core]# gdb ./imap -c core.15043 GNU gdb Red Hat Linux (5.3post-0.20021129.18rh) Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"...

warning: exec file is newer than core file. Core was generated by `imap'. Program terminated with signal 6, Aborted. Reading symbols from /lib/libdl.so.2...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/tls/libc.so.6...done. Loaded symbols for /lib/tls/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 #0 0xffffe002 in ?? () (gdb) bt #0 0xffffe002 in ?? () #1 0x42028a73 in abort () from /lib/tls/libc.so.6 #2 0x0809f9fc in i_internal_panic_handler (fmt=0x80ac360 "file %s: line %d (%s): assertion failed: (%s)", args=0xbfffdd94 "\0251\v\b?") at failures.c:375 #3 0x0809f5cb in i_panic (format=0x80ac360 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:173 #4 0x08082277 in mail_cache_transaction_reserve_more (ctx=0x80cb4a0, block_size=332, commit=true) at mail-cache-transaction.c:257 #5 0x0808248a in mail_cache_transaction_get_space (ctx=0x80cb4a0, min_size=332, max_size=332, offset_r=0x0, available_space_r=0x0, commit=true) at mail-cache-transaction.c:347 #6 0x08082b90 in mail_cache_header_add_field (ctx=0x80cb4a0, field=0) at mail-cache-transaction.c:646 #7 0x08082e0e in mail_cache_add (ctx=0x80cb4a0, seq=1, field=9, data=0x0, data_size=0) at mail-cache-transaction.c:693 #8 0x0807b314 in index_mail_cache_add (mail=0x80cfca0, field=9, data=0x0, data_size=0) at index-mail.c:349 #9 0x0807c799 in index_mail_parse_header_finish (mail=0x80cfca0) at index-mail-headers.c:75 #10 0x0807ce0c in index_mail_parse_header (part=0x42130a14, hdr=0x0, mail=0x80cfca0) at index-mail-headers.c:277 #11 0x0809b3d1 in message_parse_part_header (parser_ctx=0x80d7be8) at message-parser.c:253 #12 0x0809bb01 in message_parser_parse_header (ctx=0x80d7be8, hdr_size=0x80cfd74, callback=0, context=0x0) at message-parser.c:608 #13 0x0807cf18 in index_mail_parse_headers (mail=0x80cfca0, headers=0x80d4088) at index-mail-headers.c:361 #14 0x0807d42f in index_mail_get_headers (_mail=0x80cfca0, field=0x80b0ff5 "Date") at index-mail-headers.c:535 #15 0x0807d4d9 in index_mail_get_first_header (mail=0x80cfca0, field=0x80b0ff5 "Date") at index-mail-headers.c:576 #16 0x080933a4 in mail_get_first_header (mail=0x80d4088, field=0x80b0ff5 "Date") at mail.c:82 #17 0x0807b054 in index_mail_get_date (_mail=0x80cfca0, timezone=0x0) at index-mail.c:253 #18 0x08093370 in mail_get_date (mail=0x80d4088, timezone=0x0) at mail.c:61 #19 0x0805fe97 in mail_thread_input (ctx=0x80bd580, mail=0x80cfca0) at imap-thread.c:456 #20 0x0805f933 in imap_thread (cmd=0x80c37f4, charset=0x80c3b00 "US-ASCII", args=0x80cc628, type=MAIL_THREAD_REFERENCES) at imap-thread.c:143 #21 0x08059863 in cmd_thread (cmd=0x80c37f4) at cmd-thread.c:66 #22 0x08059949 in cmd_uid (cmd=0x80c37f4) at cmd-uid.c:19 #23 0x0805a1a7 in client_handle_input (cmd=0x80c37f4) at client.c:355 #24 0x0805a2c6 in _client_input (context=0x80c37b0) at client.c:406 #25 0x080a4ba8 in io_loop_handler_run (ioloop=0x80c1740) at ioloop-poll.c:189 #26 0x080a4201 in io_loop_run (ioloop=0x80c1740) at ioloop.c:235 #27 0x08061053 in main (argc=1, argv=0xbfffe2d4, envp=0xbfffe2dc) at main.c:238 #28 0x42015574 in __libc_start_main () from /lib/tls/libc.so.6 (gdb) i r eax 0x0 0 ecx 0x6 6 edx 0x42130a14 1108544020 ebx 0x3ac3 15043 esp 0xbfffdc10 0xbfffdc10 ebp 0xbfffdc18 0xbfffdc18 esi 0x80c9cb8 135044280 edi 0x14c 332 eip 0xffffe002 0xffffe002 eflags 0x246 582 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x33 51 (gdb)