PT-2008-6048 · Dovecot+2 · Dovecot+2

Published 2008-10-31 · Updated 2022-02-03 · CVE-2008-4870

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions dovecot version 1.0.7

Description The issue allows local users to obtain the ssl key password parameter value due to world-readable permissions for dovecot.conf.

Recommendations For dovecot version 1.0.7, consider changing the permissions of dovecot.conf to restrict access and prevent unauthorized users from reading the configuration file, specifically to protect the ssl key password parameter.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2008-4870

RHSA-2009:0205

RHSA-2009_0205

Affected Products

Debian

Red Hat

Dovecot

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2008-4870 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4870 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2008-4870 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/dovecot · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4870 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0205.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-4870 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200812-16.xml · Vendor Advisory
• http://secunia.com/advisories/32164 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=436287 · Note
• https://packages.debian.org/src:dovecot · Note
• https://access.redhat.com/errata/RHSA-2009:0205 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10776 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46323 · Note
• https://access.redhat.com/security/cve/CVE-2008-4577 · Note