Test ID:	1.3.6.1.4.1.25623.1.0.66522
Category:	FreeBSD Local Security Checks
Title:	FreeBSD Ports: dovecot
Summary:	The remote host is missing an update to the system; as announced in the referenced advisory.
Description:	Summary: The remote host is missing an update to the system as announced in the referenced advisory. Vulnerability Insight: The following package is affected: dovecot CVE-2009-3897 Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself. Solution: Update your system with the appropriate patches or software upgrades. CVSS Score: 4.6 CVSS Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3897 37084 http://www.securityfocus.com/bid/37084 37443 http://secunia.com/advisories/37443 60316 http://www.osvdb.org/60316 ADV-2009-3306 http://www.vupen.com/english/advisories/2009/3306 MDVSA-2009:306 http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 SUSE-SR:2010:001 http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html [dovecot-news] 20091120 v1.2.8 released http://www.dovecot.org/list/dovecot-news/2009-November/000143.html [oss-security] 20091120 CVE request: v1.2.8 released to fix the 0777 base_dir creation issue http://marc.info/?l=oss-security&m=125871729029145&w=2 [oss-security] 20091121 CVE Request - Dovecot - 1.2.8 http://marc.info/?l=oss-security&m=125881481222441&w=2 [oss-security] 20091123 Re: CVE Request - Dovecot - 1.2.8 http://marc.info/?l=oss-security&m=125900271508796&w=2 [oss-security] 20091123 Re: CVE request: v1.2.8 released to fix the 0777 base_dir creation issue http://marc.info/?l=oss-security&m=125900267208712&w=2 dovecot-basedir-privilege-escalation(54363) https://exchange.xforce.ibmcloud.com/vulnerabilities/54363
Copyright	Copyright (C) 2009 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.