1. CVE-Search
  2. CVE-2008-1199
ID CVE-2008-1199
Summary Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.
References
Vulnerable Configurations
  • cpe:2.3:a:dovecot:dovecot:0.99.13:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:0.99.13:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:0.99.14:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:0.99.14:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.beta2:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.beta2:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.beta3:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.beta3:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.beta7:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.beta7:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.beta8:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.beta8:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc1:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc1:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc2:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc2:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc3:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc3:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc4:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc4:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc5:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc5:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc6:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc6:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc7:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc7:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc8:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc8:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc9:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc9:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc10:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc10:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc11:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc11:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc12:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc12:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc13:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc13:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc14:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc14:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0.rc15:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0.rc15:*:*:*:*:*:*:*
  • cpe:2.3:a:dovecot:dovecot:1.0_rc29:*:*:*:*:*:*:*
    cpe:2.3:a:dovecot:dovecot:1.0_rc29:*:*:*:*:*:*:*
CVSS
Base: 4.4 (as of 11-10-2018 - 20:30)
Impact:
Exploitability:
CWE CWE-16
CAPEC
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:M/Au:N/C:P/I:P/A:P
oval via4
accepted 2013-04-29T04:08:15.128-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.
family unix
id oval:org.mitre.oval:def:10739
status accepted
submitted 2010-07-09T03:56:16-04:00
title Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.
version 19
redhat via4
advisories
bugzilla
id 436927
title CVE-2008-1199 dovecot: insecure mail_extra_groups option
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331005
    • comment dovecot is earlier than 0:1.0.7-2.el5
      oval oval:com.redhat.rhsa:tst:20080297001
    • comment dovecot is signed with Red Hat redhatrelease key
      oval oval:com.redhat.rhsa:tst:20080297002
rhsa
id RHSA-2008:0297
released 2008-05-20
severity Low
title 97: dovecot security and bug fix update (Low)
rpms
  • dovecot-0:1.0.7-2.el5
  • dovecot-debuginfo-0:1.0.7-2.el5
refmap via4
bid 28092
bugtraq 20080304 Dovecot mail_extra_groups setting is often used insecurely
debian DSA-1516
fedora
  • FEDORA-2008-2464
  • FEDORA-2008-2475
gentoo GLSA-200803-25
mlist [Dovecot-news] 20080504 v1.0.11 released
secunia
  • 29226
  • 29385
  • 29396
  • 29557
  • 30342
  • 32151
suse SUSE-SR:2008:020
ubuntu USN-593-1
xf dovecot-mailextragroups-unauth-access(41009)
statements via4
contributor Joshua Bressers
lastmodified 2008-05-21
organization Red Hat
statement Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2008-1199 This issue does not affect the default configuration of Dovecot as shipped in Red Hat Enterprise Linux. The Red Hat Security Response Team has rated this issue as having moderate security impact, a future update may address this flaw. An update to Red Hat Enterprise Linux 5 was released to correct this issue: https://rhn.redhat.com/errata/RHSA-2008-0297.html
Last major update 11-10-2018 - 20:30
Published 06-03-2008 - 21:44
Last modified 11-10-2018 - 20:30
Back to Top