[Backports-security-announce] Security Update for dovecot

Marco Nenciarini uploaded new packages for dovecot which fixed the following security problems: CVE not assigned jet Fetching a message with a huge header could have resulted in Dovecot eating a lot of CPU. An evil attacker could cause a DoS by sending forged messages. For the lenny-backports...

Null pointer dereference

The ksslkeytabisavailable function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via SS...

CVE-2010-0433

The ksslkeytabisavailable function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via SS...

Debian DSA-1892-1 : dovecot - buffer overflow

It was discovered that the SIEVE component of dovecot, a mail server that supports mbox and maildir mailboxes, is vulnerable to a buffer overflow when processing SIEVE scripts. This can be used to elevate privileges to the dovecot system user. An attacker who is able to install SIEVE scripts...

openSUSE Security Update : dovecot12 (dovecot12-1811)

Dovecot created the configured 'basedir' /var/run/dovecot with mode 0777 if it didn't exist, therefore allowing local users to mess with e.g. the authentication socket CVE-2009-3897. Note that /var/run/dovecot is part of the dovecot rpm with proper permission settings. Therefor dovecot is not...

FreeBSD Ports: dovecot

The remote host is missing an update to the system as announced in the referenced advisory. VID 30211c45-e52a-11de-b5cd-00e0815b8da8 OpenVAS Vulnerability Test $ Description: Auto generated from VID 30211c45-e52a-11de-b5cd-00e0815b8da8 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

FreeBSD Ports: dovecot

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : dovecot -- Insecure directory permissions (30211c45-e52a-11de-b5cd-00e0815b8da8)

Dovecot author reports : Dovecot v1.2.x had been creating basedir and its parents if necessary with 0777 permissions. The basedir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually. %NASLMINLEVEL 70300 C Tenable Network Security,...

[Backports-security-announce] Security Update for dovecot

Marco Nenciarini uploaded new packages for dovecot which fix the following security problem: CVE-2009-3897 Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth...

Dovecot 'base_dir' Insecure Permissions Security Bypass Vulnerability

This host has Dovecot installed and is prone to Security Bypass Vulnerability OpenVAS Vulnerability Test $Id: gbdovecotbasedirsecbypassvuln.nasl 4865 2016-12-28 16:16:43Z teissa $ Description: Dovecot 'basedir' Insecure Permissions Security Bypass Vulnerability Authors: Antu Sanadi Copyright:...

Dovecot 'base_dir' Insecure Permissions Security Bypass Vulnerability

Dovecot is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dovecot weak permissions

Weak permissions during installation...

[ MDVSA-2009:306 ] dovecot

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:306 http://www.mandriva.com/security/ Package : dovecot Date : November 29, 2009 Affected: 2010.0 Problem Description: A vulnerability was discovered and corrected in dovecot: Dovecot 1.2.x before 1.2.8 sets...

CVE-2009-3897

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the basedir directory, and possibly the basedir directory...

CVE-2009-3897

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the basedir directory, and possibly the basedir directory...

DEBIAN-CVE-2009-3897

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the basedir directory, and possibly the basedir directory...

Directory traversal

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the basedir directory, and possibly the basedir directory...

CVE-2009-3897

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the basedir directory, and possibly the basedir directory...

CVE-2009-3897

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the basedir directory, and possibly the basedir directory...

CVE-2009-3897

CVE-2009-3897 affects Dovecot 1.2.x before 1.2.8, where during installation the base_dir-related directories (and possibly the base_dir itself) are created with mode 0777. This permits a local attacker to access or replace the authentication socket and potentially access arbitrary user accounts. ...