CVE-2008-4577

Published: Oct 15, 2008Modified: Apr 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

Affected (7)

Products: Dovecot: Dovecot · Fedoraproject: Fedora · Opensuse: Opensuse · +1 more

Show all products

Dovecot: Dovecot · Fedoraproject: Fedora · Opensuse: Opensuse · Canonical: Ubuntu Linux

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dovecot Dovecot	Before 1.1.4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 8
Fedoraproject Fedora	Version 9

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 10.3-11.1

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (34)

http://bugs.gentoo.org/show_bug.cgi?id=240409

Source: secalert@redhat.com

Issue Tracking

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

Source: secalert@redhat.com

Mailing List

http://secunia.com/advisories/32164

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/32471

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/33149

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/33624

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/36904

Source: secalert@redhat.com

Broken Link

http://security.gentoo.org/glsa/glsa-200812-16.xml

Source: secalert@redhat.com

Third Party Advisory

http://www.dovecot.org/list/dovecot-news/2008-October/000085.html

Source: secalert@redhat.com

Mailing ListRelease Notes

http://www.mandriva.com/security/advisories?name=MDVSA-2008:232

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2009-0205.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/bid/31587

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-838-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2008/2745

Source: secalert@redhat.com

Permissions Required

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10376

Source: secalert@redhat.com

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00816.html

Source: secalert@redhat.com

Mailing List

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00844.html

Source: secalert@redhat.com

Mailing List

http://bugs.gentoo.org/show_bug.cgi?id=240409