oss-security - CVE Request - Dovecot

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 21 Nov 2009 15:47:19 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security <oss-security@...ts.openwall.com>
Subject: CVE Request - Dovecot - 1.2.8

Hi Josh, Steve, vendors,

   Dovecot upstream has released latest 1.2.8 version, fixing
one security issue. Quoting from news:

This is mainly to fix the 0777 base_dir creation issue, which could be
considered a security hole, exploitable by local users. An attacker
could for example replace Dovecot's auth socket and log in as other
users. Gaining root privileges isn't possible though.

This affects only v1.2 users, v1.1 and older versions were creating the
directory with 0755 permission.

References:
-----------
http://www.dovecot.org/list/dovecot-news/2009-November/000143.html
http://www.dovecot.org/index.html

Could you allocate a CVE id? (in case there isn't one already).

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.