When configured with 'mail_extra_groups' dovecot potentially allowed users to read mail boxes of other users. This is not the case in the default configuration of on openSUSE (CVE-2008-1199).

By using tab characters in passwords remote attackers could potentially acquire unauthorized access (CVE-2008-1218).

Flaws in caching LDAP data could lead to users getting logged in with the wrong account (CVE-2007-6598).

The remote host is affected by the vulnerability described in GLSA-200803-25 (Dovecot: Multiple vulnerabilities)

    Dovecot uses the group configured via the 'mail_extra_groups' setting,     which should be used to create lockfiles in the /var/mail directory,     when accessing arbitrary files (CVE-2008-1199). Dovecot does not escape     TAB characters in passwords when saving them, which might allow for     argument injection in blocking passdbs such as MySQL, PAM or shadow     (CVE-2008-1218).
  Impact :

    Remote attackers can exploit the first vulnerability to disclose     sensitive data, such as the mail of other users, or modify files or     directories that are writable by group via a symlink attack. Please     note that the 'mail_extra_groups' setting is set to the 'mail' group by     default when the 'mbox' USE flag is enabled.
    The second vulnerability can be abused to inject arguments for internal     fields. No exploitation vectors are known for this vulnerability that     affect previously stable versions of Dovecot in Gentoo.
  Workaround :

    There is no known workaround at this time.

It was discovered that the default configuration of dovecot could allow access to any email files with group 'mail' without verifying that a user had valid rights. An attacker able to create symlinks in their mail directory could exploit this to read or delete another user's email. (CVE-2008-1199)

By default, dovecot passed special characters to the underlying authentication systems. While Ubuntu releases of dovecot are not known to be vulnerable, the authentication routine was proactively improved to avoid potential future problems. (CVE-2008-1218).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

リモートホストはIMAP4 / POP3用のオープンソースのメディアストリーミングサーバーであるDovecotを実行しています。 

リモートホストにインストールされているバージョンのDovecotは、区切り文字として内部でTAB文字を使用しますが、パスワードに現れるときにそれらの文字をエスケープできません。Dovecotがブロッキングpassdbを使用するように構成されている場合、攻撃者はこの問題を利用して、認証をバイパスし、ユーザーのメールボックスへのアクセス権を取得することができます。

远程主机正在运行 Dovecot，这是一款用于 Linux / Unix 的开源 IMAP4 / POP3 服务器。 

远程主机上安装的 Dovecot 版本在内部将 TAB 字符用作分隔符，但在密码中出现时无法转义这些字符。如果 Dovecot 配置为使用阻断 passdb，则攻击者可利用此问题绕过身份验证，并获得用户邮箱的访问权限。

This update upgrades dovecot from version 1.0.10 to 1.0.13. Besides bug fixes, two security issues were fixed upstream in version 1.0.11 and 1.0.13. CVE-2008-1199 If Dovecot was configured with mail_extra_groups = mail, users having shell access to IMAP server could use this flaw to read, modify or delete mails of other users stored in inbox files in /var/mail. /var/mail directory is mail-group writable and user inbox files are by default created by useradd with permission 660, <user>:mail. No mail_extra_groups is set by default, hence default Fedora configuration was not affected by this problem.
If your configuration sets mail_extra_groups, see new options mail_privileged_group and mail_access_groups introduced in Dovecot 1.0.11. (mail_extra_groups is still accepted, but is deprecated now) CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to gain password-less login via passwords with tab characters, which were not filtered properly. Dovecot versions in Fedora were not affected by this unauthorized login flaw, but only by a related minor memory leak in dovecot-auth worker process. See referenced bugzilla for further details about this flaw.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Prior to this update, the default configuration for Dovecot used by Debian runs the server daemons with group mail privileges. This means that users with write access to their mail directory on the server (for example, through an SSH login) could read and also delete via a symbolic link mailboxes owned by other users for which they do not have direct access (CVE-2008-1199 ). In addition, an internal interpretation conflict in password handling has been addressed proactively, even though it is not known to be exploitable (CVE-2008-1218 ).

Note that applying this update requires manual action: The configuration setting 'mail_extra_groups = mail' has been replaced with 'mail_privileged_group = mail'. The update will show a configuration file conflict in /etc/dovecot/dovecot.conf. It is recommended that you keep the currently installed configuration file, and change the affected line. For your reference, the sample configuration (without your local changes) will have been written to /etc/dovecot/dovecot.conf.dpkg-new.

If your current configuration uses mail_extra_groups with a value different from 'mail', you may have to resort to themail_access_groups configuration directive.

遠端主機正在執行 Dovecot，這是一個適用於 Linux / Unix 的開放原始碼 IMAP4 / POP3 伺服器。 

遠端主機上安裝的 Dovecot 版本會在內部使用 TAB 字元做為分隔符號，但在密碼中出現這些字元時無法將其逸出。倘若將 Dovecot 設定為使用封鎖 passdb，攻擊者可利用此問題繞過驗證並取得使用者信箱的存取權。

The remote host is running Dovecot, an open source IMAP4 / POP3 server for Linux / Unix. 

The version of Dovecot installed on the remote host uses a TAB character as a delimiter internally but fails to escape them when they appear in a password.  Provided Dovecot is configured to use a blocking passdb, an attacker can leverage this issue to bypass authentication and gain access to a user's mailbox.

ID	名稱	產品	系列	已發布	已更新	嚴重性
34320	openSUSE 10 Security Update : dovecot (dovecot-5647)	Nessus	SuSE Local Security Checks	2008/10/1	2021/1/14	medium
31612	GLSA-200803-25 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2008/3/19	2021/1/6	medium
31701	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dovecot vulnerabilities (USN-593-1)	Nessus	Ubuntu Local Security Checks	2008/3/28	2021/1/19	medium
31466	Dovecotのpassdbs引数インジェクション認証バイパス	Nessus	Misc.	2008/3/14	2022/4/11	medium
31466	Dovecot passdbs 参数注入认证绕过	Nessus	Misc.	2008/3/14	2022/4/11	medium
31434	Fedora 8 : dovecot-1.0.13-6.fc8 (2008-2464)	Nessus	Fedora Local Security Checks	2008/3/13	2021/1/11	medium
31587	Debian DSA-1516-1 : dovecot - privilege escalation	Nessus	Debian Local Security Checks	2008/3/17	2021/1/4	medium
31466	Dovecot passdbs 引數插入驗證繞過	Nessus	Misc.	2008/3/14	2022/4/11	medium
31436	Fedora 7 : dovecot-1.0.13-18.fc7 (2008-2475)	Nessus	Fedora Local Security Checks	2008/3/13	2021/1/11	medium
31466	Dovecot passdbs Argument Injection Authentication Bypass	Nessus	Misc.	2008/3/14	2022/4/11	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium