plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.

dovecot granted admin rights to all owner mailboxes (CVE-2010-3706).

When using multiple ACL entries for mailboxes the most specific one was not always applied (CVE-2010-3707).

The remote host is affected by the vulnerability described in GLSA-201110-04 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause the       remote execution of arbitrary code, or a Denial of Service condition, to       conduct directory traversal attacks, corrupt data, or disclose       information.
  Workaround :

    There is no known workaround at this time.

It was discovered that the ACL plugin in Dovecot would incorrectly propagate ACLs to new mailboxes. A remote authenticated user could possibly read new mailboxes that were created with the wrong ACL.
(CVE-2010-3304)

It was discovered that the ACL plugin in Dovecot would incorrectly merge ACLs in certain circumstances. A remote authenticated user could possibly bypass intended access restrictions and gain access to mailboxes. (CVE-2010-3706, CVE-2010-3707)

It was discovered that the ACL plugin in Dovecot would incorrectly grant the admin permission to owners of certain mailboxes. A remote authenticated user could possibly bypass intended access restrictions and gain access to mailboxes. (CVE-2010-3779)

It was discovered that Dovecot incorrecly handled the simultaneous disconnect of a large number of sessions. A remote authenticated user could use this flaw to cause Dovecot to crash, resulting in a denial of service. (CVE-2010-3780).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities was discovered and corrected in dovecot :

Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox (CVE-2010-3779).

Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions (CVE-2010-3780).

The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs (CVE-2010-3304).

plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox (CVE-2010-3706).

plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox (CVE-2010-3707).

This advisory provides dovecot 1.2.15 which is not vulnerable to these issues

ID	Name	Product	Family	Severity
75471	openSUSE Security Update : dovecot12 (openSUSE-SU-2010:0923-1)	Nessus	SuSE Local Security Checks	medium
56446	GLSA-201110-04 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
51900	Ubuntu 10.04 LTS / 10.10 : dovecot vulnerabilities (USN-1059-1)	Nessus	Ubuntu Local Security Checks	medium
50425	Mandriva Linux Security Advisory : dovecot (MDVSA-2010:217)	Nessus	Mandriva Local Security Checks	medium
50417	openSUSE Security Update : dovecot12 (openSUSE-SU-2010:0923-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-3706

high

Tenable Plugins

medium

high

medium

medium

medium