From 845d43fcc08089e87cd8cdf776ebc2345fd4e1ff Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 3 Aug 2020 18:24:30 +0200
Subject: libinterimap: fail when a capability to ENABLE is missing from the
 server's CAPABILITY listing.

---
 lib/Net/IMAP/InterIMAP.pm | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lib')

diff --git a/lib/Net/IMAP/InterIMAP.pm b/lib/Net/IMAP/InterIMAP.pm
index 1bff06e..751e705 100644
--- a/lib/Net/IMAP/InterIMAP.pm
+++ b/lib/Net/IMAP/InterIMAP.pm
@@ -506,6 +506,7 @@ sub new($%) {
                    : ($self->{enable});
     if (@extensions) {
         $self->fail("Server did not advertise ENABLE (RFC 5161) capability.") unless $self->_capable('ENABLE');
+        $self->fail("Server did not advertise $_ capability.") foreach grep { !$self->_capable($_) } @extensions;
         $self->_send('ENABLE '.join(' ',@extensions));
         my @enabled = @{$self->{_ENABLED} // []};
         $self->fail("Couldn't ENABLE $_") foreach
-- 
cgit v1.2.3


From bf4175c4f5fa40c5b6385dd728d4e7732833f64c Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 3 Aug 2020 18:58:08 +0200
Subject: typofix

---
 lib/Net/IMAP/InterIMAP.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/Net/IMAP/InterIMAP.pm b/lib/Net/IMAP/InterIMAP.pm
index 751e705..906d38b 100644
--- a/lib/Net/IMAP/InterIMAP.pm
+++ b/lib/Net/IMAP/InterIMAP.pm
@@ -1680,7 +1680,7 @@ sub _start_ssl($$) {
     Net::SSLeay::CTX_set_mode($ctx,
         Net::SSLeay::MODE_ENABLE_PARTIAL_WRITE() |
         Net::SSLeay::MODE_ACCEPT_MOVING_WRITE_BUFFER() |
-        Net::SSLeay::MODE_AUTO_RETRY() | # don't fail SSL_read on renegociation
+        Net::SSLeay::MODE_AUTO_RETRY() | # don't fail SSL_read on renegotiation
         Net::SSLeay::MODE_RELEASE_BUFFERS() );
 
     if (defined (my $ciphers = $self->{SSL_cipherlist})) {
-- 
cgit v1.2.3


From bc43c0d9468a8d50ba141c8a965f9f07ed0456ff Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 3 Aug 2020 19:20:05 +0200
Subject: libinterimap: Fix response injection vulnerability after STARTTLS.

For background see https://gitlab.com/muttmua/mutt/-/issues/248 .
---
 lib/Net/IMAP/InterIMAP.pm | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'lib')

diff --git a/lib/Net/IMAP/InterIMAP.pm b/lib/Net/IMAP/InterIMAP.pm
index 906d38b..f0dd2df 100644
--- a/lib/Net/IMAP/InterIMAP.pm
+++ b/lib/Net/IMAP/InterIMAP.pm
@@ -1654,6 +1654,11 @@ sub _start_ssl($$) {
     my $ctx = Net::SSLeay::CTX_new() or $self->panic("Failed to create SSL_CTX $!");
     my $ssl_options = Net::SSLeay::OP_SINGLE_DH_USE() | Net::SSLeay::OP_SINGLE_ECDH_USE();
 
+    if (defined $self->{_OUTBUF} and $self->{_OUTBUF} ne '') {
+        $self->warn("Truncating non-empty output buffer (unauthenticated response injection?)");
+        undef $self->{_OUTBUF};
+    }
+
     $self->{SSL_protocols} //= q{!SSLv2 !SSLv3 !TLSv1 !TLSv1.1};
     my ($proto_include, $proto_exclude) = (0, 0);
     foreach (split /\s+/, $self->{SSL_protocols}) {
-- 
cgit v1.2.3


From 3b2939febdeb7f92051f95a3b08cf86e221ce21d Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 3 Aug 2020 20:27:38 +0200
Subject: libinterimap: abort on PREAUTH greeting received on plaintext
 connections

Set "STARTTLS = NO" to ignore.  This is similar to CVE-2020-12398 and
CVE-2020-14093.
---
 lib/Net/IMAP/InterIMAP.pm | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/Net/IMAP/InterIMAP.pm b/lib/Net/IMAP/InterIMAP.pm
index f0dd2df..b01e1a9 100644
--- a/lib/Net/IMAP/InterIMAP.pm
+++ b/lib/Net/IMAP/InterIMAP.pm
@@ -464,6 +464,7 @@ sub new($%) {
             $self->logger('S: xxx ', $IMAP_text);
             $self->{debug} = $dbg;
         }
+        $self->{_STATE} = 'AUTH';
 
         unless ($IMAP_text =~ /\A\Q$IMAP_cond\E \[CAPABILITY /) {
             # refresh the CAPABILITY list since the previous one had only pre-login capabilities
@@ -471,7 +472,15 @@ sub new($%) {
             $self->capabilities();
         }
     }
-    $self->{_STATE} = 'AUTH';
+    elsif ($IMAP_cond eq 'PREAUTH') {
+        if ($self->{type} eq 'imap' and $self->{STARTTLS} != 0) {
+            $self->fail("PREAUTH greeting on plaintext connection? MiTM in action? Aborting, set \"STARTTLS = NO\" to ignore.");
+        }
+        $self->{_STATE} = 'AUTH';
+    }
+    else {
+        $self->panic();
+    }
 
     # Don't send the COMPRESS command before STARTTLS or AUTH, as per RFC 4978
     if ($self->{compress} // 1 and
-- 
cgit v1.2.3