Configuration problem or false positive on STARTTLS injection test ?

Hello,

We received a message about security problem on our mail server. The 
message said

...
However, our research has highlighted some vulnerabilities associated with STARTTLS. In particular, STARTTLS can be susceptible to a command injection vulnerability. This occurs when commands are stored in a buffer and executed after the connection is upgraded to TLS, potentially allowing an attacker to inject malicious commands and compromise the security of the encrypted channel. This vulnerability, known as COMMAND INJECTION, can lead to the exposure of sensitive information, including email content and passwords.

For a detailed analysis of this vulnerability, you may refer to the paper titled "Why TLS is better without STARTTLS: A Security Analysis of STARTTLS in the Email Context."

To detect this vulnerability, we used tools available athttps://github.com/FHMS-ITS/EAST, which can identify buffering vulnerabilities in SMTP, IMAP, and POP3 protocols.
...


Well not sure to trust this but to be sure, i checked the test tool. No 
problem was detected for SMTP and IMAP but for pop3 we have the 
unattended response below

POP3: 2024-07-02 10:29:21 - INFO - Testing POP3 server at 
xxxxxxxxxxxxxxxxxxx:110
POP3: 2024-07-02 10:29:21 - DEBUG - Logdir: ./logs, Comment: 
commandinjectiontester, Timeout: 2
POP3: 2024-07-02 10:29:21 - INFO - Sanity test...
POP3: 2024-07-02 10:29:23 - TRACE - S: +OK Hello there.
POP3: 2024-07-02 10:29:23 - TRACE - C: STLS
POP3: 2024-07-02 10:29:25 - TRACE - S: +OK Begin SSL/TLS negotiation now.
POP3: 2024-07-02 10:29:25 - DEBUG - <----- TLS Handshake ----->
POP3: 2024-07-02 10:29:25 - TRACE - C: QUIT
POP3: 2024-07-02 10:29:25 - TRACE - S: +OK Better luck next time.
POP3: 2024-07-02 10:29:25 - INFO - Sanity test done
POP3: 2024-07-02 10:29:25 - INFO - Testing for command injection...
POP3: 2024-07-02 10:29:27 - TRACE - S: +OK Hello there.
POP3: 2024-07-02 10:29:27 - TRACE - C: STLS
POP3: 2024-07-02 10:29:27 - TRACE - C: CAPA
POP3: 2024-07-02 10:29:30 - TRACE - S: +OK Begin SSL/TLS negotiation now.
POP3: 2024-07-02 10:29:30 - DEBUG - <----- TLS Handshake ----->
POP3: 2024-07-02 10:29:32 - TRACE - S: +OK Here's what I can do:
POP3: 2024-07-02 10:29:32 - TRACE - S: TOP
POP3: 2024-07-02 10:29:32 - TRACE - S: USER
POP3: 2024-07-02 10:29:32 - TRACE - S: LOGIN-DELAY 10
POP3: 2024-07-02 10:29:32 - TRACE - S: PIPELINING
POP3: 2024-07-02 10:29:32 - TRACE - S: UIDL
POP3: 2024-07-02 10:29:32 - TRACE - S: UTF8 USER
POP3: 2024-07-02 10:29:32 - TRACE - S: IMPLEMENTATION Courier Mail Server
POP3: 2024-07-02 10:29:32 - TRACE - S: .
POP3: 2024-07-02 10:29:32 - WARNING - Command injection here!

I checked my configuration files and it seems we used default parameters.
If i send openssl s_client -connect xxxxxxxxxxxxxxxxxxx:110 -starttls pop3
We see we use TLSv1.3 which seems good

...
-----END CERTIFICATE-----
subject=CN = xxxxxxxxxxxxxx
issuer=C = US, O = Let's Encrypt, CN = R11
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3224 bytes and written 406 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
+OK Hello there.

So my question is, did we make a configuration error in our pop3 
settings or is this a false positive returned by this tool ?

If anyone can enlighten me, thanks in advance.

Pascal Véron

Cordialement,
Pascal Véron
VEZIM SARL




_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users