The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://secunia.com/advisories/32164 | third-party-advisory x_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/45669 | vdb-entry x_refsource_XF |
| http://secunia.com/advisories/33149 | third-party-advisory x_refsource_SECUNIA |
| http://www.vupen.com/english/advisories/2008/2745 | vdb-entry x_refsource_VUPEN |
| http://www.securityfocus.com/bid/31587 | vdb-entry x_refsource_BID |
| http://www.mandriva.com/security/advisories?name=MDVSA-2008:232 | vendor-advisory x_refsource_MANDRIVA |
| http://security.gentoo.org/glsa/glsa-200812-16.xml | vendor-advisory x_refsource_GENTOO |
| http://bugs.gentoo.org/show_bug.cgi?id=240409 | x_refsource_CONFIRM |
| http://www.dovecot.org/list/dovecot-news/2008-October/000085.html | mailing-list x_refsource_MLIST |
| http://www.securityfocus.com/archive/1/498498/100/0/threaded | mailing-list x_refsource_BUGTRAQ |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://secunia.com/advisories/32164 | third-party-advisory x_refsource_SECUNIA x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/45669 | vdb-entry x_refsource_XF x_transferred |
| http://secunia.com/advisories/33149 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.vupen.com/english/advisories/2008/2745 | vdb-entry x_refsource_VUPEN x_transferred |
| http://www.securityfocus.com/bid/31587 | vdb-entry x_refsource_BID x_transferred |
| http://www.mandriva.com/security/advisories?name=MDVSA-2008:232 | vendor-advisory x_refsource_MANDRIVA x_transferred |
| http://security.gentoo.org/glsa/glsa-200812-16.xml | vendor-advisory x_refsource_GENTOO x_transferred |
| http://bugs.gentoo.org/show_bug.cgi?id=240409 | x_refsource_CONFIRM x_transferred |
| http://www.dovecot.org/list/dovecot-news/2008-October/000085.html | mailing-list x_refsource_MLIST x_transferred |
| http://www.securityfocus.com/archive/1/498498/100/0/threaded | mailing-list x_refsource_BUGTRAQ x_transferred |
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 5.0 | MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
The risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 5.
| Hyperlink | Source | Resource |
|---|---|---|
| http://bugs.gentoo.org/show_bug.cgi?id=240409 | secalert@redhat.com | N/A |
| http://secunia.com/advisories/32164 | secalert@redhat.com | Vendor Advisory |
| http://secunia.com/advisories/33149 | secalert@redhat.com | N/A |
| http://security.gentoo.org/glsa/glsa-200812-16.xml | secalert@redhat.com | N/A |
| http://www.dovecot.org/list/dovecot-news/2008-October/000085.html | secalert@redhat.com | Patch |
| http://www.mandriva.com/security/advisories?name=MDVSA-2008:232 | secalert@redhat.com | N/A |
| http://www.securityfocus.com/archive/1/498498/100/0/threaded | secalert@redhat.com | N/A |
| http://www.securityfocus.com/bid/31587 | secalert@redhat.com | N/A |
| http://www.vupen.com/english/advisories/2008/2745 | secalert@redhat.com | N/A |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/45669 | secalert@redhat.com | N/A |