Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://secunia.com/advisories/37443 | third-party-advisory x_refsource_SECUNIA |
| http://www.osvdb.org/60316 | vdb-entry x_refsource_OSVDB |
| http://marc.info/?l=oss-security&m=125881481222441&w=2 | mailing-list x_refsource_MLIST |
| http://www.dovecot.org/list/dovecot-news/2009-November/000143.html | mailing-list x_refsource_MLIST |
| http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html | vendor-advisory x_refsource_SUSE |
| http://www.vupen.com/english/advisories/2009/3306 | vdb-entry x_refsource_VUPEN |
| http://marc.info/?l=oss-security&m=125900267208712&w=2 | mailing-list x_refsource_MLIST |
| http://marc.info/?l=oss-security&m=125871729029145&w=2 | mailing-list x_refsource_MLIST |
| http://www.securityfocus.com/bid/37084 | vdb-entry x_refsource_BID |
| http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 | vendor-advisory x_refsource_MANDRIVA |
| http://marc.info/?l=oss-security&m=125900271508796&w=2 | mailing-list x_refsource_MLIST |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/54363 | vdb-entry x_refsource_XF |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|