Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dovecot: Buffer overflow in indexer-worker process results in privilege escalation (CVE-2019-7524)

  - Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation     time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to     the parent directories of the base_dir directory, and possibly the base_dir directory itself.
    (CVE-2009-3897)

  - Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close     old connections, which allows remote attackers to cause a denial of service (resource consumption) via an     incomplete SSL/TLS handshake for an IMAP/POP3 connection. (CVE-2014-3430)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201110-04 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause the       remote execution of arbitrary code, or a Denial of Service condition, to       conduct directory traversal attacks, corrupt data, or disclose       information.
  Workaround :

    There is no known workaround at this time.

A vulnerability was discovered and corrected in dovecot :

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself (CVE-2009-3897).

The updated packages have been patched to correct these issues.

Dovecot created the configured 'base_dir' (/var/run/dovecot) with mode 0777 if it didn't exist, therefore allowing local users to mess with e.g. the authentication socket (CVE-2009-3897).

Note that /var/run/dovecot is part of the dovecot rpm with proper permission settings. Therefor dovecot is not vulnerable in the default configuration as shipped on openSUSE.

Dovecot author reports :

Dovecot v1.2.x had been creating base_dir (and its parents if necessary) with 0777 permissions. The base_dir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually.

ID	Name	Product	Family	Severity
198579	RHEL 5 : dovecot (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
56446	GLSA-201110-04 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
48160	Mandriva Linux Security Advisory : dovecot (MDVSA-2009:306)	Nessus	Mandriva Local Security Checks	medium
44053	openSUSE Security Update : dovecot12 (dovecot12-1811)	Nessus	SuSE Local Security Checks	medium
43104	FreeBSD : dovecot -- Insecure directory permissions (30211c45-e52a-11de-b5cd-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2009-3897

medium

Tenable Plugins

high

high

medium

medium

medium