Re: New release is HERE! Vexim 2.2.2 RC1, Google code, and more!

> Thank you! Some changelog would bee nice. 

I did keep a change log of all the work which Gordan and Avleen have 
both seen.

I am avoiding posting it here in full detail, because it would highlight 
specific issues that may not be immediately apparent if you are looking 
at a diff between releases.  *I strongly recommend that you either 
update or implement authentication at the webserver level using 
something like .htaccess files on apache until you get a chance - I am 
doing both on my server.*

A number of the changes are about improving the security posture of the 
entire php code, not necessarily fixing a specific vulnerability - I did 
a line by line review of the entire source twice over a period of 5 or 
so sessions.
I would email any changes from a session to Gordon, who would 
extensively perform targetted testing due to my limited time.  Then at 
the end Gordon went through and testing everything on the final exim4u 
source.
I then backported the changes from Exim4u into Vexim 2.2.1 (the php code 
is very similar at this stage).  I have to admit that while I am 
comfortable with the changes in Vexim, it hasn't had the level of 
testing the Exim4u source had.

At a high level, I would summarise some of the changes as follows:

    * Tighting of the code to ensure a domain postmaster account is only
      able to work with accounts in their own domain
    * Quoting in single quotes pretty much every variable in SQL
      statements to ensure consistency, and catch any observed or
      unobserved issues
    * The biggest outright change would be refactoring the login and
      authentication code to make it easier to audit and arguably more
      robust against potential attack - for example, notice how now the
      session variables are now populated out of the what was read from
      the database (instead of from session variables)... this approach
      was adopted so if someone could figure out how to do some kind of
      sql injection attack in the login processing (either now or via a
      human bug in a modified/later release) it would be a lot harder to
      get reserved characters like a single quote into session
      variables.  Let me just be clear - I didn't find a sql injection
      attack in the login code as it stood, but I decided to clean up
      the login/session creation/authorisation code so I could have a
      high degree of confidence I hadn't missed something there.  It was
      obvious the prior implementation that had evolved over time and
      had a few artifacts that didn't make much sense (such as doing
      more sql reads than necessary to login etc).
    * Fixed misaligned include files - e.g. the odd site php file was
      using authpostmaster instead of authsite - or something like
      that.  I think Gordon found the first instance of this.
    * Silly little things like preventing things like deleting the last
      admin account, when there was an admin alias in place.
    *  From memory I backported into vexim the code to tell you if
      standard users can login or not (I was using this for my testing,
      so was quicker for me to make the main siteadmin page show you
      this configuration setting).

I have tried to comment a lot of what I was doing, so a 
diff/winmerge/windiff with reveal specific changes in further detail.

- Mike

On 14/05/2010 6:03 p.m., Andrzej Zadrożny wrote:
> On 13.05.2010 21:24, Avleen Vig wrote:
>> With a *HUGE* thank you to Mike Garrett and Gordon Dickens who did all
>> of the work for this release.
>>
>> This is a big release, full of some quite critical security fixes.
>> This has been needed for a very long time, and I'm really glad they
>> were able to do this.
>
> Thank you! Some changelog would bee nice. 



_______________________________________________
Vexim mailing list
[email protected]
http://silverwraith.com/mailman/listinfo/vexim