Published: 10/03/2008 Updated: 11/10/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 685

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Argument injection vulnerability in Dovecot 1.0.x prior to 1.0.13, and 1.1.x prior to 1.1.rc3, when using blocking passdbs, allows remote malicious users to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dovecot dovecot

It was discovered that the default configuration of dovecot could allow access to any email files with group “mail” without verifying that a user had valid rights An attacker able to create symlinks in their mail directory could exploit this to read or delete another user’s email (CVE-2008-1199) ...

#lame Dovecot IMAP [1010 -> 11rc3] Exploit #Here's an exploit for the recent TAB vulnerability in Dovecot #It's nothing special since in the wild there are few to none #targets because of the special option which has to be set #see CVE Entry CVE-2008-1218 #Exploit written by Kingcope import sys import imaplib print "Dovecot IMAP [1010 -& ...

Dovecot IMAP versions 1010 through 11rc2 remote email disclosure exploit ...

CWE-255 http://www.dovecot.org/list/dovecot-news/2008-March/000065.html http://www.dovecot.org/list/dovecot-news/2008-March/000064.html http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0108 https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00358.html https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00381.html http://www.securityfocus.com/bid/28181 http://secunia.com/advisories/29295 http://secunia.com/advisories/29226 http://secunia.com/advisories/29364 http://www.debian.org/security/2008/dsa-1516 http://security.gentoo.org/glsa/glsa-200803-25.xml http://secunia.com/advisories/29385 http://secunia.com/advisories/29396 http://secunia.com/advisories/29557 http://secunia.com/advisories/32151 http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html https://issues.rpath.com/browse/RPL-2341 https://exchange.xforce.ibmcloud.com/vulnerabilities/41085 https://www.exploit-db.com/exploits/5257 https://usn.ubuntu.com/593-1/http://www.securityfocus.com/archive/1/489481/100/0/threaded https://usn.ubuntu.com/593-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/5257/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2008-1218

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect