CVE-2008-4578

The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes...

Design/Logic Flaw

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions...

CVE-2008-4577

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions...

CVE-2008-4577

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions...

Security feature bypass

The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes...

CVE-2008-4578

CVE-2008-4578 affects Dovecot via the ACL plugin: the k-right can bypass access restrictions to create unauthorized parent/child mailboxes. The issue is part of a set of Dovecot vulnerabilities described in GLSA 200812-16 and MDVSA-2008:232, with remediation by upgrading Dovecot to a newer versio...

CVE-2008-4577

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions...

CVE-2008-4578

The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes...

CVE-2008-4577

CVE-2008-4577 affects Dovecot; the ACL plug-in incorrectly treats negative access rights as positive, allowing bypass of access restrictions. The issue concerns Dovecot versions prior to 1.1.4 (per initial description). Various connected advisories note this vulnerability alongside CVE-2008-4870,...

CVE-2008-4577

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions...

CVE-2008-4578

The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes...

PT-2008-5795 · Dovecot +1 · Dovecot +1

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 1.1.4 Description: The issue allows attackers to bypass intended access restrictions due to the ACL plugin treating negative access rights as if they are positive access rights. Recommendations: For versions prior to...

dovecot -- ACL plugin bypass vulnerabilities

Timo Sirainen reports in dovecot 1.1.4 release notes: ACL plugin fixes: Negative rights were actually treated as positive rights. 'k' right didn't prevent creating parent/child/child mailbox. ACL groups weren't working...

openSUSE 10 Security Update : dovecot (dovecot-5647)

When configured with 'mailextragroups' dovecot potentially allowed users to read mail boxes of other users. This is not the case in the default configuration of on openSUSE CVE-2008-1199. By using tab characters in passwords remote attackers could potentially acquire unauthorized access...

Gentoo Security Advisory GLSA 200803-30 (ssl-cert.eclass)

The remote host is missing updates announced in advisory GLSA 200803-30. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200803-25 (dovecot)

The remote host is missing updates announced in advisory GLSA 200803-25. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200803-25 (dovecot)

The remote host is missing updates announced in advisory GLSA 200803-25. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200803-30 (ssl-cert.eclass)

The remote host is missing updates announced in advisory GLSA 200803-30. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD Ports: dovecot

The remote host is missing an update to the system as announced in the referenced advisory. VID b39bdc06-ee42-11dc-8678-00a0cce0781e OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: dovecot

The remote host is missing an update to the system as announced in the referenced advisory. VID cf484358-b5d6-11dc-8de0-001c2514716c OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...