PT-2010-4721 · Dovecot · Dovecot

Henri Salo · Published 2010-09-24 · Updated 2011-02-12 · CVE-2010-3304

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dovecot versions 1.2.x through 1.2.12

Description The issue allows remote attackers to read mailboxes with unintended weak ACLs due to the propagation of INBOX ACLs to newly created mailboxes in certain configurations.

Recommendations For Dovecot versions 1.2.x through 1.2.12, update to version 1.2.13 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-3304

Affected Products

Dovecot

References · 14

• http://mandriva.com/security/advisories?name=MDVSA-2010:217 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Vendor Advisory
• http://dovecot.org/list/dovecot-news/2010-July/000163.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-3304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3304 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3304 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-3304 · Vendor Advisory
• http://ubuntu.com/usn/USN-1059-1 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0301 · Note
• http://vupen.com/english/advisories/2010/2840 · Note
• http://openwall.com/lists/oss-security/2010/09/16/14 · Note
• http://openwall.com/lists/oss-security/2010/09/16/17 · Note
• http://securityfocus.com/bid/41964 · Note
• http://secunia.com/advisories/43220 · Note