From 522e698890c59f8f2218949296ee64abeea16dd0 Mon Sep 17 00:00:00 2001 From: Eygene Ryabinkin Date: Thu, 26 Nov 2009 11:34:09 +0300 Subject: [PATCH 1/3] mail/dovecot: VuXML entry for CVE-2009-3897 Signed-off-by: Eygene Ryabinkin --- security/vuxml/vuln.xml | 32 ++++++++++++++++++++++++++++++++ 1 files changed, 32 insertions(+), 0 deletions(-) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index cb372f0..beccc9b 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -35,6 +35,38 @@ Note: Please add new entries to the beginning of this file. --> + + Dovecot -- insecure directories created at installation time + + + dovecot + 1.2.01.2.8 + + + + +

Dovecot maintainers report:

+
+

This (release 1.2.8) is mainly to fix the 0777 base_dir + creation issue, which could be considered a security hole, + exploitable by local users. An attacker could for example + replace Dovecot's auth socket and log in as other users. + Gaining root privileges isn't possible though.

+
+ + + + 37084 + CVE-2009-3897 + http://dovecot.org/list/dovecot-news/2009-November/000143.html + + + 2009-25-11 + TODAY + + + bugzilla -- information leak -- 1.6.5.3