Fedora 7 : dovecot-1.0.13-18.fc7 (2008-2475)

This script is Copyright (C) 2008-2016 Tenable Network Security, Inc.


Synopsis :

The remote Fedora host is missing a security update.

Description :

This update upgrades dovecot from version 1.0.10 to 1.0.13. Besides
bug fixes, two security issues were fixed upstream in version 1.0.11
and 1.0.13. CVE-2008-1199 If Dovecot was configured with
mail_extra_groups = mail, users having shell access to IMAP server
could use this flaw to read, modify or delete mails of other users
stored in inbox files in /var/mail. /var/mail directory is mail-group
writable and user inbox files are by default created by useradd with
permission 660, <user>:mail. No mail_extra_groups is set by default,
hence default Fedora configuration was not affected by this problem.
If your configuration sets mail_extra_groups, see new options
mail_privileged_group and mail_access_groups introduced in Dovecot
1.0.11. (mail_extra_groups is still accepted, but is deprecated now)
CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to
gain password-less login via passwords with tab characters, which were
not filtered properly. Dovecot versions in Fedora were not affected by
this unauthorized login flaw, but only by a related minor memory leak
in dovecot-auth worker process. See referenced bugzilla for further
details about this flaw.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.redhat.com/show_bug.cgi?id=436927
https://bugzilla.redhat.com/show_bug.cgi?id=436928
http://www.nessus.org/u?aa34b1a8

Solution :

Update the affected dovecot package.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 5.9
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Fedora Local Security Checks

Nessus Plugin ID: 31436 (fedora_2008-2475.nasl)

Bugtraq ID: 28092
28181

CVE ID: CVE-2008-1199
CVE-2008-1218

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now