[ ispman-Bugs-1416653 ] UserMan.pm allows MailAliases for foreign domains

Bugs item #1416653, was opened at 2006-01-27 09:14
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=108390&aid=1416653&group_id=8390

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: backend
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: UserMan.pm allows MailAliases for foreign domains

Initial Comment:
If you can admin a domain, you can eavesdrop ony any
other mail account on the ISPMan box by setting an
alias to it:

Say, you can change the settings of user1@domain1. You
want to read the mail of user2@domain2, which you know
exists on your ISPMan box. Then just set up an email
alias in user1@domain1's settings, coming from
user2@domain2.

This is a security hole. Email aliases should only be
allowed for non-existing usernames/aliases (but then
ISPMan would have to check existing usernames/aliases
when creating a new user) or for the domain you set up
(and its replicas, maybe).

Attached is a fix to UserMan.pm that will add checks of
the aliases to it. It allows only aliases without '@',
or if they contain a domain name, only the user's
domain and its replicas are allowed.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=108390&aid=1416653&group_id=8390


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642