CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0CVE-2011-2167 – dovecot: directory traversal due to not obeying chroot directive
https://notcve.org/view.php?id=CVE-2011-2167
script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script. Las secuencias de comandos de inicio de sesión en Dovecot v2.0.x antes de v2.0.13 no sigue las opciones de configuración de chroot, lo que podría permitir a usuarios remotos autenticados realizar ataques de directorio transversal mediante el aprovechamiento de una secuencia de comandos. • http://dovecot.org/pipermail/dovecot/2011-May/059085.html http://openwall.com/lists/oss-security/2011/05/18/4 http://rhn.redhat.com/errata/RHSA-2013-0520.html http://secunia.com/advisories/52311 http://www.dovecot.org/doc/NEWS-2.0 http://www.securityfocus.com/bid/48003 https://exchange.xforce.ibmcloud.com/vulnerabilities/67674 https://access.redhat.com/security/cve/CVE-2011-2167 https://bugzilla.redhat.com/show_bug.cgi?id=709097 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0CVE-2011-2166 – dovecot: authenticated remote bypass of intended access restrictions
https://notcve.org/view.php?id=CVE-2011-2166
script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script. La secuencia de comandos de inicio de sesión en Dovecot v2.0.x antes de v2.0.13 no sigue la configuración del usuario y grupo, lo que podría permitir a usuarios remotos autenticados eludir las restricciones de acceso destinados al aprovechar una secuencia de comandos. • http://dovecot.org/pipermail/dovecot/2011-May/059085.html http://openwall.com/lists/oss-security/2011/05/18/4 http://rhn.redhat.com/errata/RHSA-2013-0520.html http://secunia.com/advisories/52311 http://www.dovecot.org/doc/NEWS-2.0 http://www.securityfocus.com/bid/48003 https://exchange.xforce.ibmcloud.com/vulnerabilities/67675 https://access.redhat.com/security/cve/CVE-2011-2166 https://bugzilla.redhat.com/show_bug.cgi?id=709095 • CWE-16: Configuration •
CVSS: 3.5EPSS: 0%CPEs: 16EXPL: 0CVE-2010-3779
https://notcve.org/view.php?id=CVE-2010-3779
Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox. Dovecot v1.2.x anterior a v1.2.15 y v2.0.x anterior a v2.0.beta2 proporciona permisos de administrador al propietario del cada buzón de correo en un espacio de nombres no público (non-public namespace), lo que podría permitir a usuarios autenticados remotamente evitar resctricciones de acceso intencionadas cambiando el ACL de un buzón de correo, tal y como se demostró con un buzón "symlinked shared" • http://secunia.com/advisories/43220 http://www.dovecot.org/list/dovecot/2010-October/053450.html http://www.dovecot.org/list/dovecot/2010-October/053452.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:217 http://www.ubuntu.com/usn/USN-1059-1 http://www.vupen.com/english/advisories/2010/2840 http://www.vupen.com/english/advisories/2011/0301 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 15EXPL: 0CVE-2010-3780 – Dovecot: Busy master process, receiving a lot of SIGCHLD signals rapidly while logging, could die
https://notcve.org/view.php?id=CVE-2010-3780
Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions. Dovecot v1.2.x anterior a v1.2.15 permite a usuarios autenticados remotamente provocar una denegación de servicio (interrupción del proceso maestro) mediante la desconexión simultanea de varias sesiones (1) IMAP o (2) POP3 • http://secunia.com/advisories/43220 http://www.dovecot.org/list/dovecot/2010-October/053450.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:217 http://www.redhat.com/support/errata/RHSA-2011-0600.html http://www.ubuntu.com/usn/USN-1059-1 http://www.vupen.com/english/advisories/2010/2840 http://www.vupen.com/english/advisories/2011/0301 https://access.redhat.com/security/cve/CVE-2010-3780 https://bugzilla.redhat.com/show_bug.cgi?id=641276 •
CVSS: 5.5EPSS: 0%CPEs: 20EXPL: 0CVE-2010-3707 – Dovecot: Failed to properly update ACL cache, when multiple rules defined rights for one subject
https://notcve.org/view.php?id=CVE-2010-3707
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox. plugins/acl/acl-backend-vfile.c en Dovecot v1.2.x anterior a v1.2.15 y v2.0.x anterior a 2.0.5 interpreta una entrada ACL como una directiva a añadir a los permisos concedidos por otra entrada ACL, en ciertas circunstancias involucrando entradas más específicas que tienen lugar después de entradas menos específicas, lo que permite a usuarios autenticados remotamente evitar restricciones de acceso intencionadas a través de una petición para leer o modificar un buzón de correo. • http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html http://marc.info/?l=oss-security&m=128620520732377&w=2 http://marc.info/?l=oss-security&m=128622064325688&w=2 http://secunia.com/advisories/43220 http://www.dovecot.org/list/dovecot/2010-October/053450.html http://www.dovecot.org/list/dovecot/2010-October/053451.html http://www.dovecot.org/list/dovecot/2010-October/053452.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:217 http:/ • CWE-264: Permissions, Privileges, and Access Controls •