PT-2008-6048 · Dovecot+2 · Dovecot+2

Publicado 2008-10-31 · Atualizado 2022-02-03 · CVE-2008-4870

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions dovecot version 1.0.7

Description The issue allows local users to obtain the ssl key password parameter value due to world-readable permissions for dovecot.conf.

Recommendations For dovecot version 1.0.7, consider changing the permissions of dovecot.conf to restrict access and prevent unauthorized users from reading the configuration file, specifically to protect the ssl key password parameter.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2008-4870

RHSA-2009:0205

RHSA-2009_0205

Produtos afetados

Debian

Red Hat

Dovecot

Referências · 19

• https://nvd.nist.gov/vuln/detail/CVE-2008-4870 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4870 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2008-4870 · Aviso do Fabricante
• http://secunia.com/advisories/32164 · Nota
• https://security-tracker.debian.org/tracker/source-package/dovecot · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=436287 · Nota
• https://packages.debian.org/src:dovecot · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4870 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2009:0205 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10776 · Nota
• http://redhat.com/support/errata/RHSA-2009-0205.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2008-4870 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46323 · Nota
• http://security.gentoo.org/glsa/glsa-200812-16.xml · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2008-4577 · Nota