Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation     time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to     the parent directories of the base_dir directory, and possibly the base_dir directory itself.
    (CVE-2009-3897)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201110-04 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause the       remote execution of arbitrary code, or a Denial of Service condition, to       conduct directory traversal attacks, corrupt data, or disclose       information.
  Workaround :

    There is no known workaround at this time.

A vulnerability was discovered and corrected in dovecot :

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself (CVE-2009-3897).

The updated packages have been patched to correct these issues.

Dovecot created the configured 'base_dir' (/var/run/dovecot) with mode 0777 if it didn't exist, therefore allowing local users to mess with e.g. the authentication socket (CVE-2009-3897).

Note that /var/run/dovecot is part of the dovecot rpm with proper permission settings. Therefor dovecot is not vulnerable in the default configuration as shipped on openSUSE.

Dovecot author reports :

Dovecot v1.2.x had been creating base_dir (and its parents if necessary) with 0777 permissions. The base_dir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually.

ID	Name	Product	Family	Severity
217139	Linux Distros Unpatched Vulnerability : CVE-2009-3897	Nessus	Misc.	medium
56446	GLSA-201110-04 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
48160	Mandriva Linux Security Advisory : dovecot (MDVSA-2009:306)	Nessus	Mandriva Local Security Checks	medium
44053	openSUSE Security Update : dovecot12 (dovecot12-1811)	Nessus	SuSE Local Security Checks	medium
43104	FreeBSD : dovecot -- Insecure directory permissions (30211c45-e52a-11de-b5cd-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2009-3897

medium

Tenable Plugins

medium

high

medium

medium

medium