plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-212:01 advisory.

    Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind.  It also     contains a small POP3 server.  It supports mail in either of maildir or mbox formats.
    The SQL drivers and authentication plug-ins are in their subpackages.
    Security issues fixed with this release:
    CVE-2010-3707     plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL     entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to     replace the permissions granted by another ACL entry, in certain circumstances involving more specific     entries that occur after less specific entries, which allows remote authenticated users to bypass intended     access restrictions via a request to read or modify a mailbox.
    CVE-2010-3780     Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process     outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions.
    Enhancements:
     - Upgraded to version 2.0.9. Refer to the /usr/share/doc/dovecot-2.0.9/ChangeLog file after installation     for a full list of bug fixes and improvements.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0600 advisory.

    [2.0.9-2]
    - fix issues and assert crashes found in 2.0.9 (lmtp,dotlock,zlib)

    [2.0.9-1]
    - dovecot updated to 2.0.9
    - fixed a high system CPU usage / high context switch count performance problem
    - lda: Fixed a crash when trying to send 'out of quota' reply

    [2.0.8-1]
    - dovecot updated to 2.0.8 (fixes #654226), pigeonhole updated to 0.2.2
    - IMAP: Fixed SELECT QRESYNC not to crash on mailbox close if a lot of changes w     ere being sent.
    - Fixed leaking fds when writing to dovecot.mailbox.log.
    - Fixed rare dovecot.index.cache corruption
    - zlib: Fixed several crashes, which mainly showed up with mbox.
    - acl: Fixed crashing when sometimes listing shared mailboxes via dict proxy.
    - mdbox: Fixed potential assert-crash when saving multiple messages       in one transaction
    - dsync: a lot of fixes
    - fixed lda + sieve crash

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

dovecot granted admin rights to all owner mailboxes (CVE-2010-3706).

When using multiple ACL entries for mailboxes the most specific one was not always applied (CVE-2010-3707).

Dovecot is an IMAP server for Linux, UNIX, and similar operating systems, primarily written with security in mind.

A flaw was found in the way Dovecot handled SIGCHLD signals. If a large amount of IMAP or POP3 session disconnects caused the Dovecot master process to receive these signals rapidly, it could cause the master process to crash. (CVE-2010-3780)

A flaw was found in the way Dovecot processed multiple Access Control Lists (ACL) defined for a mailbox. In some cases, Dovecot could fail to apply the more specific ACL entry, possibly resulting in more access being granted to the user than intended. (CVE-2010-3707)

This update also adds the following enhancement :

  - This erratum upgrades Dovecot to upstream version 2.0.9,     providing multiple fixes for the 'dsync' utility and     improving overall performance. Refer to the     '/usr/share/doc/dovecot-2.0.9/ChangeLog' file after     installing this update for further information about the     changes. (BZ#637056)

Users of dovecot are advised to upgrade to these updated packages, which resolve these issues and add this enhancement. After installing the updated packages, the dovecot service will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201110-04 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause the       remote execution of arbitrary code, or a Denial of Service condition, to       conduct directory traversal attacks, corrupt data, or disclose       information.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0600 advisory.

    Dovecot is an IMAP server for Linux, UNIX, and similar operating systems,     primarily written with security in mind.

    A flaw was found in the way Dovecot handled SIGCHLD signals. If a large     amount of IMAP or POP3 session disconnects caused the Dovecot master     process to receive these signals rapidly, it could cause the master process     to crash. (CVE-2010-3780)

    A flaw was found in the way Dovecot processed multiple Access Control Lists     (ACL) defined for a mailbox. In some cases, Dovecot could fail to apply the     more specific ACL entry, possibly resulting in more access being granted to     the user than intended. (CVE-2010-3707)

    This update also adds the following enhancement:

    * This erratum upgrades Dovecot to upstream version 2.0.9, providing     multiple fixes for the dsync utility and improving overall performance.
    Refer to the /usr/share/doc/dovecot-2.0.9/ChangeLog file after installing     this update for further information about the changes. (BZ#637056)

    Users of dovecot are advised to upgrade to these updated packages, which     resolve these issues and add this enhancement. After installing the updated     packages, the dovecot service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the ACL plugin in Dovecot would incorrectly propagate ACLs to new mailboxes. A remote authenticated user could possibly read new mailboxes that were created with the wrong ACL.
(CVE-2010-3304)

It was discovered that the ACL plugin in Dovecot would incorrectly merge ACLs in certain circumstances. A remote authenticated user could possibly bypass intended access restrictions and gain access to mailboxes. (CVE-2010-3706, CVE-2010-3707)

It was discovered that the ACL plugin in Dovecot would incorrectly grant the admin permission to owners of certain mailboxes. A remote authenticated user could possibly bypass intended access restrictions and gain access to mailboxes. (CVE-2010-3779)

It was discovered that Dovecot incorrecly handled the simultaneous disconnect of a large number of sessions. A remote authenticated user could use this flaw to cause Dovecot to crash, resulting in a denial of service. (CVE-2010-3780).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities was discovered and corrected in dovecot :

Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox (CVE-2010-3779).

Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions (CVE-2010-3780).

The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs (CVE-2010-3304).

plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox (CVE-2010-3706).

plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox (CVE-2010-3707).

This advisory provides dovecot 1.2.15 which is not vulnerable to these issues

ID	Name	Product	Family	Type	Severity
284287	MiracleLinux 4 : dovecot-2.0.9-2.AXS4 (AXSA:2011-212:01)	Nessus	Miracle Linux Local Security Checks	Local	high
181062	Oracle Linux 6 : dovecot (ELSA-2011-0600)	Nessus	Oracle Linux Local Security Checks	Local	high
75471	openSUSE Security Update : dovecot12 (openSUSE-SU-2010:0923-1)	Nessus	SuSE Local Security Checks	Local	medium
61039	Scientific Linux Security Update : dovecot on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	Local	medium
56446	GLSA-201110-04 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
54597	RHEL 6 : dovecot (RHSA-2011:0600)	Nessus	Red Hat Local Security Checks	Local	high
51900	Ubuntu 10.04 LTS / 10.10 : dovecot vulnerabilities (USN-1059-1)	Nessus	Ubuntu Local Security Checks	Local	medium
50425	Mandriva Linux Security Advisory : dovecot (MDVSA-2010:217)	Nessus	Mandriva Local Security Checks	Local	medium
50417	openSUSE Security Update : dovecot12 (openSUSE-SU-2010:0923-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2010-3707

high

Tenable Plugins

high

high

medium

medium

high

high

medium

medium

medium