Gentoo Security Advisory GLSA 200812-16 (dovecot)

The remote host is missing updates announced in advisory GLSA 200812-16. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

GLSA-200812-16 : Dovecot: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200812-16 Dovecot: Multiple vulnerabilities Several vulnerabilities were found in Dovecot: The 'k' right in the aclplugin does not work as expected CVE-2008-4577, CVE-2008-4578 The dovecot.conf is world-readable, providing imprope...

Dovecot: Multiple vulnerabilities

Background Dovecot is an IMAP and POP3 server written with security primarily in mind. Description Several vulnerabilities were found in Dovecot: The "k" right in the aclplugin does not work as expected CVE-2008-4577, CVE-2008-4578 The dovecot.conf is world-readable, providing improper protection...

FreeBSD Ports: dovecot-managesieve

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: dovecot-managesieve

The remote host is missing an update to the system as announced in the referenced advisory. VID 3efc106e-c451-11dd-a721-0030843d3802 OpenVAS Vulnerability Test $ Description: Auto generated from VID 3efc106e-c451-11dd-a721-0030843d3802 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Dovecot ManageSieve Server Detection

Binary data 4782.prm...

FreeBSD : dovecot-managesieve -- Script Name Directory Traversal Vulnerability (3efc106e-c451-11dd-a721-0030843d3802)

Secunia reports : The security issue is caused due to an input validation error when processing script names. This can be exploited to read or modify arbitrary files having '.sieve' extensions via directory traversal attacks, with the privileges of the attacker's user id. %NASLMINLEVEL 70300 C...

CVE-2008-5301

Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." dot dot in a script name...

CVE-2008-5301

Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." dot dot in a script name...

DEBIAN-CVE-2008-5301

Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." dot dot in a script name...

Directory traversal

Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." dot dot in a script name...

CVE-2008-5301

Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." dot dot in a script name...

CVE-2008-5301

CVE-2008-5301 affects the Dovecot ManageSieve component with versions 1.0.15, 1.1, and 1.2. The vulnerability is a directory traversal: an attacker can supply a script name containing ".." to read and modify arbitrary .sieve files on the server. This is the explicit root cause identified in the c...

[Backports-security-announce] Security Update for dovecot

Gerfried Fuchs uploaded new packages for dovecot which fixed the following security problems: CVE-2008-4577, Debian Bug 502967 The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions...

[Backports-security-announce] Security Update for dovecot

Gerfried Fuchs uploaded new packages for dovecot which fixed the following security problems: CVE-2008-4577, Debian Bug 502967 The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions...

FreeBSD Ports: dovecot

The remote host is missing an update to the system as announced in the referenced advisory. VID 75c24c1d-b688-11dd-88fd-001c2514716c OpenVAS Vulnerability Test $ Description: Auto generated from VID 75c24c1d-b688-11dd-88fd-001c2514716c Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: dovecot

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

dovecot protection bypass

Ivalid ACL parsing in ACL plugin. Privilege escalations...

[ MDVSA-2008:232 ] dovecot

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2008:232 http://www.mandriva.com/security/ Package : dovecot Date : November 19, 2008 Affected: 2009.0 Problem Description: The ACL plugin in dovecot prior to version 1.1.4 treated negative access rights as thoug...

FreeBSD : dovecot -- ACL plugin bypass vulnerabilities (75c24c1d-b688-11dd-88fd-001c2514716c)

Timo Sirainen reports in dovecot 1.1.4 release notes : ACL plugin fixes: Negative rights were actually treated as positive rights. 'k' right didn't prevent creating parent/child/child mailbox. ACL groups weren't working. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...