CVE-2009-3897

Published: Nov 24, 2009Modified: Apr 23, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

Affected (1)

Products: Dovecot: Dovecot

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dovecot Dovecot	From 1.2.0 to 1.2.8

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (24)

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html

Source: secalert@redhat.com

Mailing List

http://marc.info/?l=oss-security&m=125871729029145&w=2

Source: secalert@redhat.com

Mailing ListPatch

http://marc.info/?l=oss-security&m=125881481222441&w=2

Source: secalert@redhat.com

Mailing List

http://marc.info/?l=oss-security&m=125900267208712&w=2

Source: secalert@redhat.com

Mailing ListPatch

http://marc.info/?l=oss-security&m=125900271508796&w=2

Source: secalert@redhat.com

Mailing List

http://secunia.com/advisories/37443

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.dovecot.org/list/dovecot-news/2009-November/000143.html

Source: secalert@redhat.com

Mailing ListPatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:306

Source: secalert@redhat.com

Not Applicable

http://www.osvdb.org/60316

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/bid/37084

Source: secalert@redhat.com

Broken LinkPatchThird Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2009/3306

Source: secalert@redhat.com

PatchPermissions RequiredVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/54363

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://marc.info/?l=oss-security&m=125871729029145&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

http://marc.info/?l=oss-security&m=125881481222441&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://marc.info/?l=oss-security&m=125900267208712&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

http://marc.info/?l=oss-security&m=125900271508796&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://secunia.com/advisories/37443

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

http://www.dovecot.org/list/dovecot-news/2009-November/000143.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:306

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

http://www.osvdb.org/60316

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.securityfocus.com/bid/37084

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchThird Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2009/3306

Source: af854a3a-2127-422b-91ae-364da2661108

PatchPermissions RequiredVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/54363

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.