Published: 15/10/2008 Updated: 21/01/2024

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

The ACL plugin in Dovecot prior to 1.1.4 treats negative access rights as if they are positive access rights, which allows malicious users to bypass intended access restrictions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dovecot dovecot
fedoraproject fedora 9
fedoraproject fedora 8
opensuse opensuse 10.3-11.1
canonical ubuntu linux 9.04
canonical ubuntu linux 8.10
canonical ubuntu linux 8.04

Synopsis Low: dovecot security and bug fix update Type/Severity Security Advisory: Low Topic An updated dovecot package that corrects two security flaws and various bugsis now available for Red Hat Enterprise Linux 5This update has been rated as having low security impact by the Red HatSecurity Response Te ...

Debian Bug report logs - #502967 CVE-2008-4577/CVE-2008-4578: security problems with the ACL plugin Package: dovecot-common; Maintainer for dovecot-common is (unknown); Reported by: Steffen Joeris <steffenjoeris@skolelinuxde> Date: Tue, 21 Oct 2008 11:30:02 UTC Severity: important Tags: security Fixed in version 1:119 ...

It was discovered that the ACL plugin in Dovecot would incorrectly handle negative access rights An attacker could exploit this flaw to access the Dovecot server, bypassing the intended access restrictions This only affected Ubuntu 804 LTS (CVE-2008-4577) ...

CWE-863 http://bugs.gentoo.org/show_bug.cgi?id=240409 http://secunia.com/advisories/32164 http://www.securityfocus.com/bid/31587 http://www.dovecot.org/list/dovecot-news/2008-October/000085.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:232 http://security.gentoo.org/glsa/glsa-200812-16.xml http://secunia.com/advisories/33149 http://secunia.com/advisories/33624 http://www.redhat.com/support/errata/RHSA-2009-0205.html http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00844.html https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00816.html http://secunia.com/advisories/32471 http://www.ubuntu.com/usn/USN-838-1 http://secunia.com/advisories/36904 http://www.vupen.com/english/advisories/2008/2745 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10376 https://access.redhat.com/errata/RHSA-2009:0205 https://usn.ubuntu.com/838-1/https://nvd.nist.gov

CVE-2008-4577

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect