CVE-2008-4870

2008-11-0100:00:00

ubuntu.com

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

JSON

dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora,
uses world-readable permissions for dovecot.conf, which allows local users
to obtain the ssl_key_password parameter value.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=436287>

Notes

Author	Note
jdstrand	marking as low because the default configuration doesn’t set ssl_key_password
mdeslaur	file permissions can’t be changed because of “deliver” Red Hat backported a new “!include_try” directive to the config file that allows including a second permission-protected config file (taken from 1.1.7) Debian says “by default this file doesnt containt sensitive information and administrator changing this should ensure on its own that the mode is secure” after discussion with kees and jdstrand, here’s our plan: TODO: add a warning to the default conf file. on second thought, not worth risking a conf file prompt, so marking as ignored

Author

Note

jdstrand

marking as low because the default configuration doesn’t set ssl_key_password

mdeslaur

file permissions can’t be changed because of “deliver” Red Hat backported a new “!include_try” directive to the config file that allows including a second permission-protected config file (taken from 1.1.7) Debian says “by default this file doesnt containt sensitive information and administrator changing this should ensure on its own that the mode is secure” after discussion with kees and jdstrand, here’s our plan: TODO: add a warning to the default conf file. on second thought, not worth risking a conf file prompt, so marking as ignored