CVE ID:	CVE-2009-3897
Description:	Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.
Test IDs:	1.3.6.1.4.1.25623.1.0.66676   1.3.6.1.4.1.25623.1.0.801055   1.3.6.1.4.1.25623.1.0.66522
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3897 37084 http://www.securityfocus.com/bid/37084 37443 http://secunia.com/advisories/37443 60316 http://www.osvdb.org/60316 ADV-2009-3306 http://www.vupen.com/english/advisories/2009/3306 MDVSA-2009:306 http://www.mandriva.com/security/advisories?name=MDVSA-2009:306 SUSE-SR:2010:001 http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html [dovecot-news] 20091120 v1.2.8 released http://www.dovecot.org/list/dovecot-news/2009-November/000143.html [oss-security] 20091120 CVE request: v1.2.8 released to fix the 0777 base_dir creation issue http://marc.info/?l=oss-security&m=125871729029145&w=2 [oss-security] 20091121 CVE Request - Dovecot - 1.2.8 http://marc.info/?l=oss-security&m=125881481222441&w=2 [oss-security] 20091123 Re: CVE Request - Dovecot - 1.2.8 http://marc.info/?l=oss-security&m=125900271508796&w=2 [oss-security] 20091123 Re: CVE request: v1.2.8 released to fix the 0777 base_dir creation issue http://marc.info/?l=oss-security&m=125900267208712&w=2 dovecot-basedir-privilege-escalation(54363) https://exchange.xforce.ibmcloud.com/vulnerabilities/54363