CVE-2009-3897

low-risk
Published 2009-11-24

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

Do I need to act?

-
0.08% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Dovecot

References (24)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html
Mailing List http://marc.info/?l=oss-security&m=125871729029145&w=2
Mailing List http://marc.info/?l=oss-security&m=125881481222441&w=2
Mailing List http://marc.info/?l=oss-security&m=125900267208712&w=2
Mailing List http://marc.info/?l=oss-security&m=125900271508796&w=2
Broken Link http://secunia.com/advisories/37443
Mailing List http://www.dovecot.org/list/dovecot-news/2009-November/000143.html
Not Applicable http://www.mandriva.com/security/advisories?name=MDVSA-2009:306
Broken Link http://www.osvdb.org/60316
Broken Link http://www.securityfocus.com/bid/37084
Patch http://www.vupen.com/english/advisories/2009/3306
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/54363
Mailing List http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html
Mailing List http://marc.info/?l=oss-security&m=125871729029145&w=2
Mailing List http://marc.info/?l=oss-security&m=125881481222441&w=2
Mailing List http://marc.info/?l=oss-security&m=125900267208712&w=2
Mailing List http://marc.info/?l=oss-security&m=125900271508796&w=2
Broken Link http://secunia.com/advisories/37443
Mailing List http://www.dovecot.org/list/dovecot-news/2009-November/000143.html
Not Applicable http://www.mandriva.com/security/advisories?name=MDVSA-2009:306
and 4 more references
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal