Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2008-0297 advisory.

    - LDAP+auth cache user login mixup (CVE-2007-6598, #427575)
    - insecure mail_extra_groups option (CVE-2008-1199, #436927)
    - update to latest upstream, fixes a few bugs (#331441, #245249), plus two       security vulnerabilities (CVE-2007-2231, CVE-2007-4211)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the way Dovecot handled the 'mail_extra_groups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199)

This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options
-- 'mail_privileged_group' and 'mail_access_groups' -- to minimize the usage of additional privileges.

A directory traversal flaw was discovered in Dovecot's zlib plug-in.
An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231)

A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the 'COPY' and 'APPEND' commands to set additional message flags. (CVE-2007-4211)

A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598)

As well, this updated package fixes the following bugs :

  - configuring 'userdb' and 'passdb' to use LDAP caused     Dovecot to hang. A segmentation fault may have occurred.
    In this updated package, using an LDAP backend for     'userdb' and 'passdb' no longer causes Dovecot to hang.

  - the Dovecot 'login_process_size' limit was configured     for 32-bit systems. On 64-bit systems, when Dovecot was     configured to use either IMAP or POP3, the log in     processes crashed with out-of-memory errors. Errors such     as the following were logged :

pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

In this updated package, the 'login_process_size' limit is correctly configured on 64-bit systems, which resolves this issue.

Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397

An updated dovecot package that fixes several security issues and various bugs is now available for Red Hat Enterprise Linux 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Dovecot is an IMAP server for Linux and UNIX-like systems, primarily written with security in mind.

A flaw was discovered in the way Dovecot handled the 'mail_extra_groups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199)

This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options
-- 'mail_privileged_group' and 'mail_access_groups' -- to minimize the usage of additional privileges.

A directory traversal flaw was discovered in Dovecot's zlib plug-in.
An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231)

A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the 'COPY' and 'APPEND' commands to set additional message flags. (CVE-2007-4211)

A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598)

As well, this updated package fixes the following bugs :

* configuring 'userdb' and 'passdb' to use LDAP caused Dovecot to hang. A segmentation fault may have occurred. In this updated package, using an LDAP backend for 'userdb' and 'passdb' no longer causes Dovecot to hang.

* the Dovecot 'login_process_size' limit was configured for 32-bit systems. On 64-bit systems, when Dovecot was configured to use either IMAP or POP3, the log in processes crashed with out-of-memory errors.
Errors such as the following were logged :

pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate memory

In this updated package, the 'login_process_size' limit is correctly configured on 64-bit systems, which resolves this issue.

Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397

Users of dovecot are advised to upgrade to this updated package, which resolves these issues.

It was discovered that Dovecot, when configured to use non-system-user spools and compressed folders, would allow directory traversals in mailbox names. Remote authenticated users could potentially read email owned by other users.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that dovecot, a secure mail server that supports mbox and maildir mailboxes, when configured to use non-system-user spools and compressed folders, may allow directory traversal in mailbox names.

ID	Name	Product	Family	Severity
180598	Oracle Linux 5 : dovecot (ELSA-2008-0297)	Nessus	Oracle Linux Local Security Checks	high
60404	Scientific Linux Security Update : dovecot on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
32423	RHEL 5 : dovecot (RHSA-2008:0297)	Nessus	Red Hat Local Security Checks	medium
28088	Ubuntu 6.06 LTS / 6.10 / 7.04 : dovecot vulnerability (USN-487-1)	Nessus	Ubuntu Local Security Checks	medium
25959	Debian DSA-1359-1 : dovecot - directory traversal	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2007-2231

high

Tenable Plugins

high

medium

medium

medium

medium