FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-3897

This CVE name corresponds to:

Entered	Topic
2009-12-10	dovecot -- Insecure directory permissions

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-3897 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-3897
Phase	Assigned(20091105)

Description

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

References

Source	Reference
MLIST	[dovecot-news] 20091120 v1.2.8 released
MLIST	[oss-security] 20091120 CVE request: v1.2.8 released to fix the 0777 base_dir creation issue
MLIST	[oss-security] 20091121 CVE Request - Dovecot - 1.2.8
MLIST	[oss-security] 20091123 Re: CVE Request - Dovecot - 1.2.8
MLIST	[oss-security] 20091123 Re: CVE request: v1.2.8 released to fix the 0777 base_dir creation issue
MANDRIVA	MDVSA-2009:306
SUSE	SUSE-SR:2010:001
BID	37084
OSVDB	60316
SECUNIA	37443
VUPEN	ADV-2009-3306
XF	dovecot-basedir-privilege-escalation(54363)