PT-2010-5016 · Dovecot+1 · Dovecot+1

Timo Sirainen · Publicado 2010-10-06 · Atualizado 2011-08-27 · CVE-2010-3707

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dovecot versions 1.2.x through 1.2.14 Dovecot versions 2.0.x through 2.0.4

Description The issue allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox, due to incorrect interpretation of ACL entries.

Recommendations For Dovecot versions 1.2.x through 1.2.14, update to version 1.2.15 or later. For Dovecot versions 2.0.x through 2.0.4, update to version 2.0.5 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-3707

RHSA-2011:0600

RHSA-2011_0600

Produtos afetados

Dovecot

Red Hat

Referências · 21

• https://linux.oracle.com/errata/ELSA-2011-0600.html · Aviso do Fabricante
• http://marc.info/?l=oss-security&m=128620520732377&w=2 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2010:217 · Aviso do Fabricante
• http://dovecot.org/list/dovecot/2010-October/053450.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2011-0600.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/2840 · Nota
• https://access.redhat.com/errata/RHSA-2011:0600 · Nota
• https://access.redhat.com/security/cve/CVE-2010-3707 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3707 · Nota de Segurança
• http://ubuntu.com/usn/USN-1059-1 · Aviso do Fabricante
• http://dovecot.org/list/dovecot/2010-October/053451.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html · Aviso do Fabricante
• http://dovecot.org/list/dovecot/2010-October/053452.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3707 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0301 · Nota