Full Disclosure mailing list archives
Re: IMAP4rev1 2000.283 allows access to system files
From: full-disclosure () lists netsys com (Kurt Seifried)
Date: Sun, 11 Aug 2002 15:27:32 -0600
Uh. This is EXPECTED behaviour, as in "yes, we know about it, it's designed to do this, and has been doing this since the dawn of time". If you do not like it you can: a) chroot the users to their home dir, which is a REAL pain in the ass if their mail spool is in /var/spool/mail or something similar, you will also need to copy various library files/etc in. b) use a different imap server such as cyrus which uses an internal mail store Kurt Seifried, kurt () seifried org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/
Current thread:
- IMAP4rev1 2000.283 allows access to system files Guy Cohen (Aug 10)
- IMAP4rev1 2000.283 allows access to system files Joao Gouveia (Aug 10)
- Re: IMAP4rev1 2000.283 allows access to system files Guy Cohen (Aug 11)
- Re: IMAP4rev1 2000.283 allows access to system files Kurt Seifried (Aug 11)
- Re: IMAP4rev1 2000.283 allows access to system files Ron DuFresne (Aug 11)
- Re: IMAP4rev1 2000.283 allows access to system files Guy Cohen (Aug 11)
- IMAP4rev1 2000.283 allows access to system files Joao Gouveia (Aug 10)