First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 240409
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Robert Buchholz <rbu@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 240409 depends on: Show dependency tree
Bug 240409 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2008-10-07 18:06 0000 
Secunia wrote:
Two security issues have been reported in Dovecot, which can be
exploited by malicious users to bypass certain security
restrictions.

1) The problem is that the ACL plugin interprets negative access
rights as positive access rights, potentially giving an unprivileged
user access to restricted resources.

2) An error in the ACL plugin when imposing mailbox creation
restrictions can be exploited to create "parent/child/child"
mailboxes.

The security issues are reported in versions prior to 1.1.4.

SOLUTION:
Update to version 1.1.4.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://www.dovecot.org/list/dovecot-news/2008-October/000085.html

------- Comment #1 From Robert Buchholz 2008-10-07 18:09:09 0000 ------- 
rating B3 since I would think only few people use this, and worst case should
be data loss.

------- Comment #2 From Wolfram Schlich 2008-10-08 08:15:33 0000 ------- 
1.1.4 is in the tree since 2008-10-06.

------- Comment #3 From Robert Buchholz 2008-10-08 08:47:28 0000 ------- 
Arches, please test and mark stable:
=net-mail/dovecot-1.1.4-r1
Target keywords : "alpha amd64 ppc sparc x86"

------- Comment #4 From Markus Meier 2008-10-08 19:15:31 0000 ------- 
amd64/x86 stable

------- Comment #5 From Tobias Scherbaum 2008-10-11 17:49:41 0000 ------- 
ppc stable

------- Comment #6 From Friedrich Oslage 2008-10-12 13:51:31 0000 ------- 
sparc stable

------- Comment #7 From Raúl Porcel 2008-10-12 18:10:27 0000 ------- 
alpha stable

------- Comment #8 From Robert Buchholz 2008-11-09 13:06:37 0000 ------- 
yes with 244962

------- Comment #9 From Tobias Heinlein 2008-11-30 18:39:18 0000 ------- 
YES too, request already in the pool.

------- Comment #10 From Tobias Heinlein 2008-12-15 13:53:56 0000 ------- 
GLSA 200812-16, thanks everyone, sorry about the delay.
First Last Prev Next    No search results available      Search page      Enter new bug