Test ID:	1.3.6.1.4.1.25623.1.0.801055
Category:	Privilege escalation
Title:	Dovecot 'base_dir' Insecure Permissions Security Bypass Vulnerability
Summary:	Dovecot is prone to a security bypass vulnerability.
Description:	Summary: Dovecot is prone to a security bypass vulnerability. Vulnerability Insight: This flaw is due to insecure permissions (0777) being set on the 'base_dir' directory and its parents, which could allow malicious users to replace auth sockets and log in as other users. Vulnerability Impact: Successful attack could allow malicious people to log in as another user, which may aid in further attacks. Affected Software/OS: Dovecot versions 1.2 before 1.2.8. Solution: Apply the patch or upgrade to Dovecot version 1.2.8. CVSS Score: 4.6 CVSS Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3897 37084 http://www.securityfocus.com/bid/37084 37443 http://secunia.com/advisories/37443 60316 http://www.osvdb.org/60316 ADV-2009-3306 http://www.vupen.com/english/advisories/2009/3306 MDVSA-2009:306 http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 SUSE-SR:2010:001 http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html [dovecot-news] 20091120 v1.2.8 released http://www.dovecot.org/list/dovecot-news/2009-November/000143.html [oss-security] 20091120 CVE request: v1.2.8 released to fix the 0777 base_dir creation issue http://marc.info/?l=oss-security&m=125871729029145&w=2 [oss-security] 20091121 CVE Request - Dovecot - 1.2.8 http://marc.info/?l=oss-security&m=125881481222441&w=2 [oss-security] 20091123 Re: CVE Request - Dovecot - 1.2.8 http://marc.info/?l=oss-security&m=125900271508796&w=2 [oss-security] 20091123 Re: CVE request: v1.2.8 released to fix the 0777 base_dir creation issue http://marc.info/?l=oss-security&m=125900267208712&w=2 dovecot-basedir-privilege-escalation(54363) https://exchange.xforce.ibmcloud.com/vulnerabilities/54363
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.