Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 240409 (CVE-2008-4577) - net-mail/dovecot < 1.1.4 acl_plugin privilege escalation (CVE-2008-4577,CVE-2008-4578)
Summary: net-mail/dovecot < 1.1.4 acl_plugin privilege escalation (CVE-2008-4577,CVE-2...
Alias: CVE-2008-4577
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
Whiteboard: B3? [glsa]
Depends on:
Reported: 2008-10-07 18:06 UTC by Robert Buchholz (RETIRED)
Modified: 2008-12-15 13:53 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Robert Buchholz (RETIRED) gentoo-dev 2008-10-07 18:06:58 UTC
Secunia wrote:
Two security issues have been reported in Dovecot, which can be
exploited by malicious users to bypass certain security

1) The problem is that the ACL plugin interprets negative access
rights as positive access rights, potentially giving an unprivileged
user access to restricted resources.

2) An error in the ACL plugin when imposing mailbox creation
restrictions can be exploited to create "parent/child/child"

The security issues are reported in versions prior to 1.1.4.

Update to version 1.1.4.

Reported by the vendor.

Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2008-10-07 18:09:09 UTC
rating B3 since I would think only few people use this, and worst case should be data loss.
Comment 2 Wolfram Schlich (RETIRED) gentoo-dev 2008-10-08 08:15:33 UTC
1.1.4 is in the tree since 2008-10-06.
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2008-10-08 08:47:28 UTC
Arches, please test and mark stable:
Target keywords : "alpha amd64 ppc sparc x86"
Comment 4 Markus Meier gentoo-dev 2008-10-08 19:15:31 UTC
amd64/x86 stable
Comment 5 Tobias Scherbaum (RETIRED) gentoo-dev 2008-10-11 17:49:41 UTC
ppc stable
Comment 6 Friedrich Oslage (RETIRED) gentoo-dev 2008-10-12 13:51:31 UTC
sparc stable
Comment 7 Raúl Porcel (RETIRED) gentoo-dev 2008-10-12 18:10:27 UTC
alpha stable
Comment 8 Robert Buchholz (RETIRED) gentoo-dev 2008-11-09 13:06:37 UTC
yes with 244962
Comment 9 Tobias Heinlein (RETIRED) gentoo-dev 2008-11-30 18:39:18 UTC
YES too, request already in the pool.
Comment 10 Tobias Heinlein (RETIRED) gentoo-dev 2008-12-15 13:53:56 UTC
GLSA 200812-16, thanks everyone, sorry about the delay.