An updated dovecot package that fixes several security issues and various bugs is now available for Red Hat Enterprise Linux 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Dovecot is an IMAP server for Linux and UNIX-like systems, primarily written with security in mind.

A flaw was discovered in the way Dovecot handled the 'mail_extra_groups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199)

This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options
-- 'mail_privileged_group' and 'mail_access_groups' -- to minimize the usage of additional privileges.

A directory traversal flaw was discovered in Dovecot's zlib plug-in.
An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231)

A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the 'COPY' and 'APPEND' commands to set additional message flags. (CVE-2007-4211)

A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598)

As well, this updated package fixes the following bugs :

* configuring 'userdb' and 'passdb' to use LDAP caused Dovecot to hang. A segmentation fault may have occurred. In this updated package, using an LDAP backend for 'userdb' and 'passdb' no longer causes Dovecot to hang.

* the Dovecot 'login_process_size' limit was configured for 32-bit systems. On 64-bit systems, when Dovecot was configured to use either IMAP or POP3, the log in processes crashed with out-of-memory errors.
Errors such as the following were logged :

pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

In this updated package, the 'login_process_size' limit is correctly configured on 64-bit systems, which resolves this issue.

Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397

Users of dovecot are advised to upgrade to this updated package, which resolves these issues.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2008-0297 advisory.

    - LDAP+auth cache user login mixup (CVE-2007-6598, #427575)
    - insecure mail_extra_groups option (CVE-2008-1199, #436927)
    - update to latest upstream, fixes a few bugs (#331441, #245249), plus two       security vulnerabilities (CVE-2007-2231, CVE-2007-4211)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the way Dovecot handled the 'mail_extra_groups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199)

This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options
-- 'mail_privileged_group' and 'mail_access_groups' -- to minimize the usage of additional privileges.

A directory traversal flaw was discovered in Dovecot's zlib plug-in.
An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231)

A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the 'COPY' and 'APPEND' commands to set additional message flags. (CVE-2007-4211)

A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598)

As well, this updated package fixes the following bugs :

  - configuring 'userdb' and 'passdb' to use LDAP caused     Dovecot to hang. A segmentation fault may have occurred.
    In this updated package, using an LDAP backend for     'userdb' and 'passdb' no longer causes Dovecot to hang.

  - the Dovecot 'login_process_size' limit was configured     for 32-bit systems. On 64-bit systems, when Dovecot was     configured to use either IMAP or POP3, the log in     processes crashed with out-of-memory errors. Errors such     as the following were logged :

pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

In this updated package, the 'login_process_size' limit is correctly configured on 64-bit systems, which resolves this issue.

Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397

It was discovered that dovecot, a secure mail server that supports mbox and maildir mailboxes, when configured to use non-system-user spools and compressed folders, may allow directory traversal in mailbox names.

It was discovered that Dovecot, when configured to use non-system-user spools and compressed folders, would allow directory traversals in mailbox names. Remote authenticated users could potentially read email owned by other users.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2008-76:01 advisory.

    Dovecot is an IMAP server for Linux/UNIX-like systems, written with security     primarily in mind.  It also contains a small POP3 server.  It supports mail     in either of maildir or mbox formats.
    CVE-2007-2231: Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29,     when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files)     via a .. (dot dot) sequence in the mailbox name.
    CVE-2007-4211:The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert     right to save certain flags via a (1) COPY or (2) APPEND command.
    CVE-2007-6598: Dovecot before 1.0.10, with certain configuration options including use of %variables, does     not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a     different user who has the same password.
    CVE-2008-1199: Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create     dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify     files or directories that are writable by group, via a symlink attack.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
32423	RHEL 5 : dovecot (RHSA-2008:0297)	Nessus	Red Hat Local Security Checks	5/22/2008	1/14/2021	medium
180598	Oracle Linux 5 : dovecot (ELSA-2008-0297)	Nessus	Oracle Linux Local Security Checks	9/7/2023	10/22/2024	high
60404	Scientific Linux Security Update : dovecot on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
25959	Debian DSA-1359-1 : dovecot - directory traversal	Nessus	Debian Local Security Checks	9/3/2007	1/4/2021	medium
28088	Ubuntu 6.06 LTS / 6.10 / 7.04 : dovecot vulnerability (USN-487-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium
284053	MiracleLinux 3 : dovecot-1.0.7-2.1AXS3 (AXSA:2008-76:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	high

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

high