CVE-2008-1199

Published: Mar 6, 2008Modified: Apr 23, 2026

4.4

Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 3.4 / Impact: 6.4

Source: NVD

Description

Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.

Affected (32)

Products: Dovecot: Dovecot

1 product

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Dovecot Dovecot	Version 0.99.13
Dovecot Dovecot	Version 0.99.14
Dovecot Dovecot	Version 1.0.10
Dovecot Dovecot	Version 1.0.2
Dovecot Dovecot	Version 1.0.3
Dovecot Dovecot	Version 1.0.4
Dovecot Dovecot	Version 1.0.5
Dovecot Dovecot	Version 1.0.6
Dovecot Dovecot	Version 1.0.7
Dovecot Dovecot	Version 1.0.8
Dovecot Dovecot	Version 1.0.9
Dovecot Dovecot	Version 1.0.beta2
Dovecot Dovecot	Version 1.0.beta3
Dovecot Dovecot	Version 1.0.beta7
Dovecot Dovecot	Version 1.0.beta8
Dovecot Dovecot	Version 1.0.rc10
Dovecot Dovecot	Version 1.0.rc11
Dovecot Dovecot	Version 1.0.rc12
Dovecot Dovecot	Version 1.0.rc13
Dovecot Dovecot	Version 1.0.rc14
Dovecot Dovecot	Version 1.0.rc15
Dovecot Dovecot	Version 1.0.rc1
Dovecot Dovecot	Version 1.0.rc2
Dovecot Dovecot	Version 1.0.rc3
Dovecot Dovecot	Version 1.0.rc4
Dovecot Dovecot	Version 1.0.rc5
Dovecot Dovecot	Version 1.0.rc6
Dovecot Dovecot	Version 1.0.rc7
Dovecot Dovecot	Version 1.0.rc8
Dovecot Dovecot	Version 1.0.rc9
Dovecot Dovecot	Version 1.0
Dovecot Dovecot	Version 1.0_rc29

Related CWEs

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (36)

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html

Source: cve@mitre.org

http://secunia.com/advisories/29226

Source: cve@mitre.org

http://secunia.com/advisories/29385

Source: cve@mitre.org

http://secunia.com/advisories/29396

Source: cve@mitre.org

http://secunia.com/advisories/29557

Source: cve@mitre.org

http://secunia.com/advisories/30342

Source: cve@mitre.org

http://secunia.com/advisories/32151

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200803-25.xml

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1516

Source: cve@mitre.org

http://www.dovecot.org/list/dovecot-news/2008-March/000061.html

Source: cve@mitre.org

Patch

http://www.redhat.com/support/errata/RHSA-2008-0297.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/489133/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/28092

Source: cve@mitre.org

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/41009

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10739

Source: cve@mitre.org

https://usn.ubuntu.com/593-1/

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00358.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00381.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/29226

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/29385

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/29396

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/29557

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/30342

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32151

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-200803-25.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2008/dsa-1516

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.dovecot.org/list/dovecot-news/2008-March/000061.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.redhat.com/support/errata/RHSA-2008-0297.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/489133/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/28092

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/41009

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10739

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/593-1/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00358.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00381.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.