Re: Heartbleed: dovecot2 is still vulnerable after upgrade of OpenSSL library

2014-04-28 Thread Winfried Dietmayer
Hi Clemens, > - Dovecot still has an old copy of OpenSSL embedded that it uses for > those places that handle the TLS connection. I think that one is > unlikely given that you did rebuild dovecot and that it has been > revbumped. Nevertheless you should be able to rule it out by > re-inst

Re: Heartbleed: dovecot2 is still vulnerable after upgrade of OpenSSL library

2014-04-23 Thread Winfried Dietmayer
Hi Clemens, > Instead, please set `import_environment = DYLD_PRINT_LIBRARIES` in > your > dovecot.conf and restart dovecot with > $> sudo env DYLD_PRINT_LIBRARIES=1 dovecot -F. It looks the same here: Apr 23 10:55:55 Winfrieds-.local dovecot[66453]: imap-login: Error: dyld: loade

Re: Heartbleed: dovecot2 is still vulnerable after upgrade of OpenSSL library

2014-04-22 Thread Winfried Dietmayer
Hi, thanks for your analysis so far. > How do you start dovecot? $ sudo port load dovecot2 > What does `env | grep DYLD_` print on your system? --> no output > What's the output of `sudo env DYLD_PRINT_LIBRARIES=1 dovecot -F` > on your system? dyld: loaded: /opt/local/sbin/dov

Re: Heartbleed: dovecot2 is still vulnerable after upgrade of OpenSSL library

2014-04-21 Thread Winfried Dietmayer
Hi Clemens, thank you for your quick response. But I’m not sure whether you are right. I forced a rebuild of first the OpenSSL library and then of dovecot. I already posted the result. According to your proposition this should have solved the issue. But it didn’t. dovecot2 does link the curr

Heartbleed: dovecot2 is still vulnerable after upgrade of OpenSSL library

2014-04-21 Thread Winfried Dietmayer
Hello, I use the following version of dovecot2 and OpenSSL: $ port installed | egrep "dovecot|openssl" --> dovecot2 @2.2.12_0 (active) --> openssl @1.0.1g_0 (active) I attack the dovecot server: $ ./cardiac-arrest.py -a -p 993 localhost | grep -i fail --> [