Detections
Analytics

Fedora 24 : 1:dovecot (2016-bb22a24d3d)

medium Nessus Plugin ID 96057

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

- Fixed crash in auth process when auth-policy was configured and authentication was aborted/failed without a username set.

 - director: If two users had different tags but the same hash, the users may have been redirected to the wrong tag's hosts.

 - Index files may have been thought incorrectly lost, causing 'Missing middle file seq=..' to be logged and index rebuild. This happened more easily with IMAP hibernation enabled.

 - Various fixes to restoring state correctly in un-hibernation.

 - dovecot.index files were commonly 4 bytes per email too large. This is because 3 bytes per email were being wasted that could have been used for IMAP keywords.

 - Various fixes to handle dovecot.list.index corruption better.

 - lib-fts: Fixed assert-crash in address tokenizer with specific input.

 - Fixed assert-crash in HTML to text parsing with specific input (e.g. for FTS indexing or snippet generation)

 - doveadm sync -1: Fixed handling mailbox GUID conflicts.

 - sdbox, mdbox: Perform full index rebuild if corruption is detected inside lib-index, which runs index fsck.

 - quota: Don't skip quota checks when moving mails between different quota roots.

 - search: Multiple sequence sets or UID sets in search parameters weren't handled correctly. They were incorrectly merged together.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected 1:dovecot package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2016-bb22a24d3d

Plugin Details

Severity: Medium

ID: 96057

File Name: fedora_2016-bb22a24d3d.nasl

Version: 3.6

Type: local

Agent: unix

Published: 12/22/2016

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:1:dovecot, cpe:/o:fedoraproject:fedora:24

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 12/22/2016

Vulnerability Publication Date: 2/17/2017

Reference Information

CVE: CVE-2016-8652