CVE-2009-3897

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.6 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html	Mailing List
http://marc.info/?l=oss-security&m=125871729029145&w=2	Mailing List Patch
http://marc.info/?l=oss-security&m=125881481222441&w=2	Mailing List
http://marc.info/?l=oss-security&m=125900267208712&w=2	Mailing List Patch
http://marc.info/?l=oss-security&m=125900271508796&w=2	Mailing List
http://secunia.com/advisories/37443	Broken Link Vendor Advisory
http://www.dovecot.org/list/dovecot-news/2009-November/000143.html	Mailing List Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:306	Not Applicable
http://www.osvdb.org/60316	Broken Link
http://www.securityfocus.com/bid/37084	Broken Link Patch Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2009/3306	Patch Permissions Required Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54363	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2009-11-24 17:30

Updated : 2024-02-08 15:21

NVD link : CVE-2009-3897

Mitre link : CVE-2009-3897

CVE.ORG link : CVE-2009-3897

JSON object : View

Products Affected

dovecot

dovecot

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2009-3897", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2009-11-24T17:30:00.407", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html", "tags": ["Mailing List"], "source": "secalert@redhat.com"}, {"url": "http://marc.info/?l=oss-security&m=125871729029145&w=2", "tags": ["Mailing List", "Patch"], "source": "secalert@redhat.com"}, {"url": "http://marc.info/?l=oss-security&m=125881481222441&w=2", "tags": ["Mailing List"], "source": "secalert@redhat.com"}, {"url": "http://marc.info/?l=oss-security&m=125900267208712&w=2", "tags": ["Mailing List", "Patch"], "source": "secalert@redhat.com"}, {"url": "http://marc.info/?l=oss-security&m=125900271508796&w=2", "tags": ["Mailing List"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/37443", "tags": ["Broken Link", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.dovecot.org/list/dovecot-news/2009-November/000143.html", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:306", "tags": ["Not Applicable"], "source": "secalert@redhat.com"}, {"url": "http://www.osvdb.org/60316", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/37084", "tags": ["Broken Link", "Patch", "Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://www.vupen.com/english/advisories/2009/3306", "tags": ["Patch", "Permissions Required", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54363", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself."}, {"lang": "es", "value": "Dovecot v1.2.x anterior v1.2.8 establece permisos 0777 durante la creaci\u00f3n de ciertos directorios en el momento de la instalaci\u00f3n, permitiendo a usuarios locales acceder a las cuentas de usuarios por reemplazamiento del socket auth, relacionados con los directorios padre del directorio base_dir, y probablemente con el propio directorio base_dir\r\n"}], "lastModified": "2024-02-08T15:21:34.730", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A697E475-79C0-45FD-9529-022CBC15921D", "versionEndExcluding": "1.2.8", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}