Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2008-76:01 advisory.

    Dovecot is an IMAP server for Linux/UNIX-like systems, written with security     primarily in mind.  It also contains a small POP3 server.  It supports mail     in either of maildir or mbox formats.
    CVE-2007-2231: Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29,     when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files)     via a .. (dot dot) sequence in the mailbox name.
    CVE-2007-4211:The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert     right to save certain flags via a (1) COPY or (2) APPEND command.
    CVE-2007-6598: Dovecot before 1.0.10, with certain configuration options including use of %variables, does     not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a     different user who has the same password.
    CVE-2008-1199: Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create     dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify     files or directories that are writable by group, via a symlink attack.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2008-0297 advisory.

    - LDAP+auth cache user login mixup (CVE-2007-6598, #427575)
    - insecure mail_extra_groups option (CVE-2008-1199, #436927)
    - update to latest upstream, fixes a few bugs (#331441, #245249), plus two       security vulnerabilities (CVE-2007-2231, CVE-2007-4211)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the way Dovecot handled the 'mail_extra_groups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199)

This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options
-- 'mail_privileged_group' and 'mail_access_groups' -- to minimize the usage of additional privileges.

A directory traversal flaw was discovered in Dovecot's zlib plug-in.
An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231)

A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the 'COPY' and 'APPEND' commands to set additional message flags. (CVE-2007-4211)

A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598)

As well, this updated package fixes the following bugs :

  - configuring 'userdb' and 'passdb' to use LDAP caused     Dovecot to hang. A segmentation fault may have occurred.
    In this updated package, using an LDAP backend for     'userdb' and 'passdb' no longer causes Dovecot to hang.

  - the Dovecot 'login_process_size' limit was configured     for 32-bit systems. On 64-bit systems, when Dovecot was     configured to use either IMAP or POP3, the log in     processes crashed with out-of-memory errors. Errors such     as the following were logged :

pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

In this updated package, the 'login_process_size' limit is correctly configured on 64-bit systems, which resolves this issue.

Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397

When configured with 'mail_extra_groups' dovecot potentially allowed users to read mail boxes of other users. This is not the case in the default configuration of on openSUSE (CVE-2008-1199).

By using tab characters in passwords remote attackers could potentially acquire unauthorized access (CVE-2008-1218).

Flaws in caching LDAP data could lead to users getting logged in with the wrong account (CVE-2007-6598).

An updated dovecot package that fixes several security issues and various bugs is now available for Red Hat Enterprise Linux 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Dovecot is an IMAP server for Linux and UNIX-like systems, primarily written with security in mind.

A flaw was discovered in the way Dovecot handled the 'mail_extra_groups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199)

This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options
-- 'mail_privileged_group' and 'mail_access_groups' -- to minimize the usage of additional privileges.

A directory traversal flaw was discovered in Dovecot's zlib plug-in.
An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231)

A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the 'COPY' and 'APPEND' commands to set additional message flags. (CVE-2007-4211)

A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598)

As well, this updated package fixes the following bugs :

* configuring 'userdb' and 'passdb' to use LDAP caused Dovecot to hang. A segmentation fault may have occurred. In this updated package, using an LDAP backend for 'userdb' and 'passdb' no longer causes Dovecot to hang.

* the Dovecot 'login_process_size' limit was configured for 32-bit systems. On 64-bit systems, when Dovecot was configured to use either IMAP or POP3, the log in processes crashed with out-of-memory errors.
Errors such as the following were logged :

pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

In this updated package, the 'login_process_size' limit is correctly configured on 64-bit systems, which resolves this issue.

Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397

Users of dovecot are advised to upgrade to this updated package, which resolves these issues.

It was discovered that in very rare configurations using LDAP, Dovecot may reuse cached connections for users with the same password. As a result, a user may be able to login as another if the connection is reused. The default Ubuntu configuration of Dovecot was not vulnerable.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Dovecot, a POP3 and IMAP server, only when used # Remark: 'base' refers to a variable(?!) and should not contain something as # base = %r! with LDAP authentication and 'base' contains variables, could allow a user to log in to the account of another user with the same password.

ID	Name	Product	Family	Severity
284053	MiracleLinux 3 : dovecot-1.0.7-2.1AXS3 (AXSA:2008-76:01)	Nessus	Miracle Linux Local Security Checks	high
180598	Oracle Linux 5 : dovecot (ELSA-2008-0297)	Nessus	Oracle Linux Local Security Checks	high
60404	Scientific Linux Security Update : dovecot on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
34320	openSUSE 10 Security Update : dovecot (dovecot-5647)	Nessus	SuSE Local Security Checks	medium
32423	RHEL 5 : dovecot (RHSA-2008:0297)	Nessus	Red Hat Local Security Checks	medium
29964	Ubuntu 7.04 / 7.10 : dovecot vulnerability (USN-567-1)	Nessus	Ubuntu Local Security Checks	medium
29904	Debian DSA-1457-1 : dovecot - programming error	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2007-6598

critical

Tenable Plugins

high

high

medium

medium

medium

medium

medium