PT-2011-3654 · Dovecot+2 · Dovecot+2

Published 2011-05-24 · Updated 2017-08-29 · CVE-2011-2166

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dovecot versions 2.0.x through 2.0.12

Description The issue concerns a problem where the script-login in Dovecot does not follow the user and group configuration settings. This might allow remote authenticated users to bypass intended access restrictions by leveraging a script.

Recommendations For Dovecot versions 2.0.x through 2.0.12, update to version 2.0.13 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CESA-2013_0520

CVE-2011-2166

RHSA-2013:0520

RHSA-2013_0520

Affected Products

Centos

Dovecot

Red Hat

References · 28

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2167 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0520.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4318 · Security Note
• https://osv.dev/vulnerability/CVE-2011-2166 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2166 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2166 · Vendor Advisory
• http://dovecot.org/pipermail/dovecot/2011-May/059085.html · Patch
• http://openwall.com/lists/oss-security/2011/05/18/4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-2166 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-2166 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0520.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2013-0520.html · Note
• https://access.redhat.com/security/cve/CVE-2011-2166 · Note
• https://access.redhat.com/errata/RHSA-2013:0520 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67675 · Note