PT-2011-3655 · Dovecot+2 · Dovecot+2

Henri Salo · Published 2011-05-24 · Updated 2017-08-29 · CVE-2011-2167

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dovecot versions 2.0.x through 2.0.12

Description The issue concerns a problem where the script-login in Dovecot does not follow the chroot configuration setting. This might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.

Recommendations For Dovecot versions 2.0.x through 2.0.12, update to version 2.0.13 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CESA-2013_0520

CVE-2011-2167

RHSA-2013:0520

RHSA-2013_0520

Affected Products

Centos

Dovecot

Red Hat

References · 28

• http://dovecot.org/pipermail/dovecot/2011-May/059085.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2011-2167 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-2167 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/05/18/4 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2167 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2167 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2167 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0520.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4318 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2166 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0520.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2013-0520.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67674 · Note
• https://access.redhat.com/security/cve/CVE-2011-2166 · Note
• https://lists.centos.org/pipermail/centos-announce/2013-March/056237.html · Note