CVE-2009-3897

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2009-3897
Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html Mailing List
http://marc.info/?l=oss-security&m=125871729029145&w=2 Mailing List Patch
http://marc.info/?l=oss-security&m=125881481222441&w=2 Mailing List
http://marc.info/?l=oss-security&m=125900267208712&w=2 Mailing List Patch
http://marc.info/?l=oss-security&m=125900271508796&w=2 Mailing List
http://secunia.com/advisories/37443 Broken Link Vendor Advisory
http://www.dovecot.org/list/dovecot-news/2009-November/000143.html Mailing List Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 Not Applicable
http://www.osvdb.org/60316 Broken Link
http://www.securityfocus.com/bid/37084 Broken Link Patch Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2009/3306 Patch Permissions Required Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54363 Third Party Advisory VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html Mailing List
http://marc.info/?l=oss-security&m=125871729029145&w=2 Mailing List Patch
http://marc.info/?l=oss-security&m=125881481222441&w=2 Mailing List
http://marc.info/?l=oss-security&m=125900267208712&w=2 Mailing List Patch
http://marc.info/?l=oss-security&m=125900271508796&w=2 Mailing List
http://secunia.com/advisories/37443 Broken Link Vendor Advisory
http://www.dovecot.org/list/dovecot-news/2009-November/000143.html Mailing List Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 Not Applicable
http://www.osvdb.org/60316 Broken Link
http://www.securityfocus.com/bid/37084 Broken Link Patch Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2009/3306 Patch Permissions Required Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54363 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*
History

21 Nov 2024, 01:08

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html - Mailing List () http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html - Mailing List
References () http://marc.info/?l=oss-security&m=125871729029145&w=2 - Mailing List, Patch () http://marc.info/?l=oss-security&m=125871729029145&w=2 - Mailing List, Patch
References () http://marc.info/?l=oss-security&m=125881481222441&w=2 - Mailing List () http://marc.info/?l=oss-security&m=125881481222441&w=2 - Mailing List
References () http://marc.info/?l=oss-security&m=125900267208712&w=2 - Mailing List, Patch () http://marc.info/?l=oss-security&m=125900267208712&w=2 - Mailing List, Patch
References () http://marc.info/?l=oss-security&m=125900271508796&w=2 - Mailing List () http://marc.info/?l=oss-security&m=125900271508796&w=2 - Mailing List
References () http://secunia.com/advisories/37443 - Broken Link, Vendor Advisory () http://secunia.com/advisories/37443 - Broken Link, Vendor Advisory
References () http://www.dovecot.org/list/dovecot-news/2009-November/000143.html - Mailing List, Patch, Vendor Advisory () http://www.dovecot.org/list/dovecot-news/2009-November/000143.html - Mailing List, Patch, Vendor Advisory
References () http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 - Not Applicable () http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 - Not Applicable
References () http://www.osvdb.org/60316 - Broken Link () http://www.osvdb.org/60316 - Broken Link
References () http://www.securityfocus.com/bid/37084 - Broken Link, Patch, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/37084 - Broken Link, Patch, Third Party Advisory, VDB Entry
References () http://www.vupen.com/english/advisories/2009/3306 - Patch, Permissions Required, Vendor Advisory () http://www.vupen.com/english/advisories/2009/3306 - Patch, Permissions Required, Vendor Advisory
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/54363 - Third Party Advisory, VDB Entry () https://exchange.xforce.ibmcloud.com/vulnerabilities/54363 - Third Party Advisory, VDB Entry

08 Feb 2024, 15:21

Type Values Removed Values Added
CPE cpe:2.3:a:dovecot:dovecot:1.2.7:*:*:*:*:*:*:*
cpe:2.3:a:dovecot:dovecot:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:dovecot:dovecot:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:dovecot:dovecot:1.2.5:*:*:*:*:*:*:*
cpe:2.3:a:dovecot:dovecot:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:dovecot:dovecot:1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:dovecot:dovecot:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:dovecot:dovecot:1.2.1:*:*:*:*:*:*:*		 cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*
CWE CWE-264 CWE-732
CVSS v2 : 4.6
v3 : unknown 		v2 : 4.6
v3 : 5.5
References (OSVDB) http://www.osvdb.org/60316 - (OSVDB) http://www.osvdb.org/60316 - Broken Link
References (MLIST) http://marc.info/?l=oss-security&m=125881481222441&w=2 - (MLIST) http://marc.info/?l=oss-security&m=125881481222441&w=2 - Mailing List
References (MLIST) http://marc.info/?l=oss-security&m=125900267208712&w=2 - Patch (MLIST) http://marc.info/?l=oss-security&m=125900267208712&w=2 - Mailing List, Patch
References (MLIST) http://www.dovecot.org/list/dovecot-news/2009-November/000143.html - Patch, Vendor Advisory (MLIST) http://www.dovecot.org/list/dovecot-news/2009-November/000143.html - Mailing List, Patch, Vendor Advisory
References (MLIST) http://marc.info/?l=oss-security&m=125900271508796&w=2 - (MLIST) http://marc.info/?l=oss-security&m=125900271508796&w=2 - Mailing List
References (VUPEN) http://www.vupen.com/english/advisories/2009/3306 - Patch, Vendor Advisory (VUPEN) http://www.vupen.com/english/advisories/2009/3306 - Patch, Permissions Required, Vendor Advisory
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 - Not Applicable
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/54363 - (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/54363 - Third Party Advisory, VDB Entry
References (SECUNIA) http://secunia.com/advisories/37443 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/37443 - Broken Link, Vendor Advisory
References (BID) http://www.securityfocus.com/bid/37084 - Patch (BID) http://www.securityfocus.com/bid/37084 - Broken Link, Patch, Third Party Advisory, VDB Entry
References (MLIST) http://marc.info/?l=oss-security&m=125871729029145&w=2 - Patch (MLIST) http://marc.info/?l=oss-security&m=125871729029145&w=2 - Mailing List, Patch
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html - Mailing List
Information

Published : 2009-11-24 17:30

Updated : 2025-04-09 00:30

NVD link : CVE-2009-3897

Mitre link : CVE-2009-3897

CVE.ORG link : CVE-2009-3897

JSON object : View

Products Affected

dovecot

  • dovecot
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource