PT-2009-6119 · Dovecot · Dovecot

Timo Sirainen · Published 2009-11-24 · Updated 2024-02-08 · CVE-2009-3897

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dovecot versions 1.2.x through 1.2.7

Description The issue allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base dir directory, and possibly the base dir directory itself. This is due to Dovecot setting 0777 permissions during the creation of certain directories at installation time.

Recommendations For Dovecot versions 1.2.x through 1.2.7, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected directories to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2009-3897

Affected Products

Dovecot

References · 17

• http://secunia.com/advisories/37443 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3897 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:306 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3306 · Vendor Advisory
• http://securityfocus.com/bid/37084 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html · Vendor Advisory
• http://marc.info/?l=oss-security&m=125871729029145&w=2 · Patch
• https://osv.dev/vulnerability/CVE-2009-3897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3897 · Security Note
• http://marc.info/?l=oss-security&m=125900267208712&w=2 · Patch
• https://security-tracker.debian.org/tracker/CVE-2009-3897 · Vendor Advisory
• http://dovecot.org/list/dovecot-news/2009-November/000143.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54363 · Note
• http://marc.info/?l=oss-security&m=125900271508796&w=2 · Note
• http://osvdb.org/60316 · Note