A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dovecot insecure SSL/TLS key and certificate file creation (CVE-2016-4983)

  - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a     situation with a complex regular expression for the regex extension. (CVE-2020-28200)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - dovecot insecure SSL/TLS key and certificate file creation (CVE-2016-4983)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dovecot: Buffer overflow in indexer-worker process results in privilege escalation (CVE-2019-7524)

  - A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS     key files. (CVE-2016-4983)

  - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users. (CVE-2019-3814)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dovecot: Buffer overflow in indexer-worker process results in privilege escalation (CVE-2019-7524)

  - Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation     time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to     the parent directories of the base_dir directory, and possibly the base_dir directory itself.
    (CVE-2009-3897)

  - Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close     old connections, which allows remote attackers to cause a denial of service (resource consumption) via an     incomplete SSL/TLS handshake for an IMAP/POP3 connection. (CVE-2014-3430)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for dovecot22 fixes the following issues :

  - insecure SSL/TLS key and certificate file creation     (CVE-2016-4983) (bnc #984639)

  - Fix LDAP based authentication for some setups (boo     #1003952)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot22 fixes the following issues :

  - dovecot insecure SSL/TLS key and certificate file     creation (CVE-2016-4983, bnc#984639)

ID	Name	Product	Family	Severity
198674	RHEL 7 : dovecot (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
198673	RHEL 4 : dovecot (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
198627	RHEL 6 : dovecot (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198579	RHEL 5 : dovecot (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
95369	SUSE SLES12 Security Update : dovecot22 (SUSE-SU-2016:2915-1)	Nessus	SuSE Local Security Checks	low
95274	openSUSE Security Update : dovecot22 (openSUSE-2016-1342)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2016-4983

low

Tenable Plugins

low

low

high

high

low

low