rhsa-2009_0205
Vulnerability from csaf_redhat
Published
2009-01-20 15:45
Modified
2024-11-22 02:17
Summary
Red Hat Security Advisory: dovecot security and bug fix update

Notes

Topic
An updated dovecot package that corrects two security flaws and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team.
Details
Dovecot is an IMAP server for Linux and UNIX-like systems, primarily written with security in mind. A flaw was found in Dovecot's ACL plug-in. The ACL plug-in treated negative access rights as positive rights, which could allow an attacker to bypass intended access restrictions. (CVE-2008-4577) A password disclosure flaw was found with Dovecot's configuration file. If a system had the "ssl_key_password" option defined, any local user could view the SSL key password. (CVE-2008-4870) Note: This flaw did not allow the attacker to acquire the contents of the SSL key. The password has no value without the key file which arbitrary users should not have read access to. To better protect even this value, however, the dovecot.conf file now supports the "!include_try" directive. The ssl_key_password option should be moved from dovecot.conf to a new file owned by, and only readable and writable by, root (ie 0600). This file should be referenced from dovecot.conf by setting the "!include_try [/path/to/password/file]" option. Additionally, this update addresses the following bugs: * the dovecot init script -- /etc/rc.d/init.d/dovecot -- did not check if the dovecot binary or configuration files existed. It also used the wrong pid file for checking the dovecot service's status. This update includes a new init script that corrects these errors. * the %files section of the dovecot spec file did not include "%dir %{ssldir}/private". As a consequence, the /etc/pki/private/ directory was not owned by dovecot. (Note: files inside /etc/pki/private/ were and are owned by dovecot.) With this update, the missing line has been added to the spec file, and the noted directory is now owned by dovecot. * in some previously released versions of dovecot, the authentication process accepted (and passed along un-escaped) passwords containing characters that had special meaning to dovecot's internal protocols. This updated release prevents such passwords from being passed back, instead returning the error, "Attempted login with password having illegal chars". Note: dovecot versions previously shipped with Red Hat Enterprise Linux 5 did not allow this behavior. This update addresses the issue above but said issue was only present in versions of dovecot not previously included with Red Hat Enterprise Linux 5. Users of dovecot are advised to upgrade to this updated package, which addresses these vulnerabilities and resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated dovecot package that corrects two security flaws and various bugs\nis now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Dovecot is an IMAP server for Linux and UNIX-like systems, primarily\nwritten with security in mind.\n\nA flaw was found in Dovecot\u0027s ACL plug-in. The ACL plug-in treated negative\naccess rights as positive rights, which could allow an attacker to bypass\nintended access restrictions. (CVE-2008-4577)\n\nA password disclosure flaw was found with Dovecot\u0027s configuration file. If\na system had the \"ssl_key_password\" option defined, any local user could\nview the SSL key password. (CVE-2008-4870)\n\nNote: This flaw did not allow the attacker to acquire the contents of the\nSSL key. The password has no value without the key file which arbitrary\nusers should not have read access to.\n\nTo better protect even this value, however, the dovecot.conf file now\nsupports the \"!include_try\" directive. The ssl_key_password option should\nbe moved from dovecot.conf to a new file owned by, and only readable and\nwritable by, root (ie 0600). This file should be referenced from\ndovecot.conf by setting the \"!include_try [/path/to/password/file]\" option.\n\nAdditionally, this update addresses the following bugs:\n\n* the dovecot init script -- /etc/rc.d/init.d/dovecot -- did not check if\nthe dovecot binary or configuration files existed. It also used the wrong\npid file for checking the dovecot service\u0027s status. This update includes a\nnew init script that corrects these errors.\n\n* the %files section of the dovecot spec file did not include \"%dir\n%{ssldir}/private\". As a consequence, the /etc/pki/private/ directory was\nnot owned by dovecot. (Note: files inside /etc/pki/private/ were and are\nowned by dovecot.) With this update, the missing line has been added to the\nspec file, and the noted directory is now owned by dovecot.\n\n* in some previously released versions of dovecot, the authentication\nprocess accepted (and passed along un-escaped) passwords containing\ncharacters that had special meaning to dovecot\u0027s internal protocols. This\nupdated release prevents such passwords from being passed back, instead\nreturning the error, \"Attempted login with password having illegal chars\".\n\nNote: dovecot versions previously shipped with Red Hat Enterprise Linux 5\ndid not allow this behavior. This update addresses the issue above but said\nissue was only present in versions of dovecot not previously included with\nRed Hat Enterprise Linux 5.\n\nUsers of dovecot are advised to upgrade to this updated package, which\naddresses these vulnerabilities and resolves these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2009:0205",
        "url": "https://access.redhat.com/errata/RHSA-2009:0205"
      },
      {
        "category": "external",
        "summary": "http://www.redhat.com/security/updates/classification/#low",
        "url": "http://www.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "238016",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=238016"
      },
      {
        "category": "external",
        "summary": "436287",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=436287"
      },
      {
        "category": "external",
        "summary": "439369",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=439369"
      },
      {
        "category": "external",
        "summary": "448089",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=448089"
      },
      {
        "category": "external",
        "summary": "467436",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=467436"
      },
      {
        "category": "external",
        "summary": "469659",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=469659"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0205.json"
      }
    ],
    "title": "Red Hat Security Advisory: dovecot security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T02:17:23+00:00",
      "generator": {
        "date": "2024-11-22T02:17:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2009:0205",
      "initial_release_date": "2009-01-20T15:45:00+00:00",
      "revision_history": [
        {
          "date": "2009-01-20T15:45:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2009-01-20T11:06:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T02:17:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
                  "product_id": "5Client-Workstation",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client_workstation"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux (v. 5 server)",
                "product": {
                  "name": "Red Hat Enterprise Linux (v. 5 server)",
                  "product_id": "5Server",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-7.el5.src",
                "product": {
                  "name": "dovecot-0:1.0.7-7.el5.src",
                  "product_id": "dovecot-0:1.0.7-7.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-7.el5?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-7.el5.x86_64",
                "product": {
                  "name": "dovecot-0:1.0.7-7.el5.x86_64",
                  "product_id": "dovecot-0:1.0.7-7.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-7.el5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
                  "product_id": "dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-7.el5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-7.el5.i386",
                "product": {
                  "name": "dovecot-0:1.0.7-7.el5.i386",
                  "product_id": "dovecot-0:1.0.7-7.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-7.el5?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-7.el5.i386",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-7.el5.i386",
                  "product_id": "dovecot-debuginfo-0:1.0.7-7.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-7.el5?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-7.el5.ia64",
                "product": {
                  "name": "dovecot-0:1.0.7-7.el5.ia64",
                  "product_id": "dovecot-0:1.0.7-7.el5.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-7.el5?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-7.el5.ia64",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-7.el5.ia64",
                  "product_id": "dovecot-debuginfo-0:1.0.7-7.el5.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-7.el5?arch=ia64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ia64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-7.el5.ppc",
                "product": {
                  "name": "dovecot-0:1.0.7-7.el5.ppc",
                  "product_id": "dovecot-0:1.0.7-7.el5.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-7.el5?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-7.el5.ppc",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-7.el5.ppc",
                  "product_id": "dovecot-debuginfo-0:1.0.7-7.el5.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-7.el5?arch=ppc"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-7.el5.s390x",
                "product": {
                  "name": "dovecot-0:1.0.7-7.el5.s390x",
                  "product_id": "dovecot-0:1.0.7-7.el5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-7.el5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-7.el5.s390x",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-7.el5.s390x",
                  "product_id": "dovecot-debuginfo-0:1.0.7-7.el5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-7.el5?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-7.el5.i386"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.i386",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-7.el5.ia64"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.ia64",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-7.el5.ppc"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.ppc",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-7.el5.s390x"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.s390x",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-7.el5.src"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.src",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-7.el5.x86_64"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.x86_64",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.i386"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.i386",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ia64"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.ia64",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ppc"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.ppc",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.s390x"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.s390x",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.x86_64"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-7.el5.i386"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-7.el5.ia64"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.ia64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-7.el5.ppc"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.ppc",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-7.el5.s390x"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.s390x",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-7.el5.src"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.src",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-7.el5.x86_64"
        },
        "product_reference": "dovecot-0:1.0.7-7.el5.x86_64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-7.el5.i386"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ia64"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.ia64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ppc"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.ppc",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-7.el5.s390x"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.s390x",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-7.el5.x86_64"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
        "relates_to_product_reference": "5Server"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2008-4577",
      "discovery_date": "2008-10-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "467436"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dovecot: incorrect handling of negative rights in the ACL plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.i386",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.ia64",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.ppc",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.s390x",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.src",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.x86_64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.i386",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
          "5Server:dovecot-0:1.0.7-7.el5.i386",
          "5Server:dovecot-0:1.0.7-7.el5.ia64",
          "5Server:dovecot-0:1.0.7-7.el5.ppc",
          "5Server:dovecot-0:1.0.7-7.el5.s390x",
          "5Server:dovecot-0:1.0.7-7.el5.src",
          "5Server:dovecot-0:1.0.7-7.el5.x86_64",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.i386",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-4577"
        },
        {
          "category": "external",
          "summary": "RHBZ#467436",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=467436"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-4577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-4577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-4577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4577"
        }
      ],
      "release_date": "2008-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-01-20T15:45:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
          "product_ids": [
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.i386",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.ia64",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.ppc",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.s390x",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.src",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.x86_64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.i386",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
            "5Server:dovecot-0:1.0.7-7.el5.i386",
            "5Server:dovecot-0:1.0.7-7.el5.ia64",
            "5Server:dovecot-0:1.0.7-7.el5.ppc",
            "5Server:dovecot-0:1.0.7-7.el5.s390x",
            "5Server:dovecot-0:1.0.7-7.el5.src",
            "5Server:dovecot-0:1.0.7-7.el5.x86_64",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.i386",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:0205"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.i386",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.ia64",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.ppc",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.s390x",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.src",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.x86_64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.i386",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
            "5Server:dovecot-0:1.0.7-7.el5.i386",
            "5Server:dovecot-0:1.0.7-7.el5.ia64",
            "5Server:dovecot-0:1.0.7-7.el5.ppc",
            "5Server:dovecot-0:1.0.7-7.el5.s390x",
            "5Server:dovecot-0:1.0.7-7.el5.src",
            "5Server:dovecot-0:1.0.7-7.el5.x86_64",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.i386",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "dovecot: incorrect handling of negative rights in the ACL plugin"
    },
    {
      "cve": "CVE-2008-4870",
      "discovery_date": "2008-03-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "469659"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dovecot: ssl_key_password disclosure due to an insecure dovecot.conf permissions",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.i386",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.ia64",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.ppc",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.s390x",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.src",
          "5Client-Workstation:dovecot-0:1.0.7-7.el5.x86_64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.i386",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
          "5Server:dovecot-0:1.0.7-7.el5.i386",
          "5Server:dovecot-0:1.0.7-7.el5.ia64",
          "5Server:dovecot-0:1.0.7-7.el5.ppc",
          "5Server:dovecot-0:1.0.7-7.el5.s390x",
          "5Server:dovecot-0:1.0.7-7.el5.src",
          "5Server:dovecot-0:1.0.7-7.el5.x86_64",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.i386",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
          "5Server:dovecot-debuginfo-0:1.0.7-7.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-4870"
        },
        {
          "category": "external",
          "summary": "RHBZ#469659",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=469659"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-4870",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-4870"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-4870",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4870"
        }
      ],
      "release_date": "2008-03-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-01-20T15:45:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
          "product_ids": [
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.i386",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.ia64",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.ppc",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.s390x",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.src",
            "5Client-Workstation:dovecot-0:1.0.7-7.el5.x86_64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.i386",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-7.el5.x86_64",
            "5Server:dovecot-0:1.0.7-7.el5.i386",
            "5Server:dovecot-0:1.0.7-7.el5.ia64",
            "5Server:dovecot-0:1.0.7-7.el5.ppc",
            "5Server:dovecot-0:1.0.7-7.el5.s390x",
            "5Server:dovecot-0:1.0.7-7.el5.src",
            "5Server:dovecot-0:1.0.7-7.el5.x86_64",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.i386",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ia64",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.ppc",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.s390x",
            "5Server:dovecot-debuginfo-0:1.0.7-7.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:0205"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "dovecot: ssl_key_password disclosure due to an insecure dovecot.conf permissions"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.