PT-2011-3655 · Dovecot+2 · Dovecot+2

Henri Salo · Publicado 2011-05-24 · Atualizado 2017-08-29 · CVE-2011-2167

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dovecot versions 2.0.x through 2.0.12

Description The issue concerns a problem where the script-login in Dovecot does not follow the chroot configuration setting. This might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.

Recommendations For Dovecot versions 2.0.x through 2.0.12, update to version 2.0.13 or later to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CESA-2013_0520

CVE-2011-2167

RHSA-2013:0520

RHSA-2013_0520

Produtos afetados

Centos

Dovecot

Red Hat

Referências · 28

• http://dovecot.org/pipermail/dovecot/2011-May/059085.html · Correção
• https://rhn.redhat.com/errata/RHSA-2013-0520.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-2167 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-2167 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67674 · Nota
• https://access.redhat.com/security/cve/CVE-2011-2166 · Nota
• https://lists.centos.org/pipermail/centos-announce/2013-March/056237.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/026821.html · Nota
• http://openwall.com/lists/oss-security/2011/05/18/4 · Correção
• https://access.redhat.com/security/cve/CVE-2011-2167 · Nota
• https://lists.centos.org/pipermail/centos-announce/2013-March/081480.html · Nota
• https://access.redhat.com/errata/RHSA-2013:0520 · Nota
• https://access.redhat.com/security/cve/CVE-2011-4318 · Nota
• https://lists.centos.org/pipermail/centos-announce/2013-March/068793.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/006751.html · Nota