CVE-2008-4577
published 2008-10-15CVE-2008-4577: The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access…
PriorityP335high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
2.33%
81.7th percentile
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | dovecot | < dovecot 1:1.0.15-2.2 (bookworm) | dovecot 1:1.0.15-2.2 (bookworm) |
| dovecot | dovecot | < 1.1.4 | 1.1.4 |
| dovecot | dovecot | >= 0 < 1:1.0.15-2.2 | 1:1.0.15-2.2 |
| dovecot | dovecot | >= 0 < 1:1.0.15-2.2 | 1:1.0.15-2.2 |
| dovecot | dovecot | >= 0 < 1:1.0.15-2.2 | 1:1.0.15-2.2 |
| dovecot | dovecot | >= 0 < 1:1.0.15-2.2 | 1:1.0.15-2.2 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| opensuse | opensuse | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-24jq-h48j-g592: The ACL plugin in Dovecot before 1
ghsa_unreviewed·2022-05-02
CVE-2008-4577 [MEDIUM] CWE-863 GHSA-24jq-h48j-g592: The ACL plugin in Dovecot before 1
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
OSV
CVE-2008-4577: The ACL plugin in Dovecot before 1
osv·2008-10-15·CVSS 7.5
CVE-2008-4577 [HIGH] CVE-2008-4577: The ACL plugin in Dovecot before 1
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
Ubuntu
Dovecot vulnerabilities
vendor_ubuntu·2009-09-28·CVSS 7.5
CVE-2008-4577 [HIGH] Dovecot vulnerabilities
Title: Dovecot vulnerabilities
Summary: Dovecot vulnerabilities
It was discovered that the ACL plugin in Dovecot would incorrectly handle
negative access rights. An attacker could exploit this flaw to access the
Dovecot server, bypassing the intended access restrictions. This only
affected Ubuntu 8.04 LTS. (CVE-2008-4577)
It was discovered that the ManageSieve service in Dovecot incorrectly
handled ".." in script names. A remote attacker could exploit this to read
and modify arbitrary sieve files on the server. This only affected Ubuntu
8.10. (CVE-2008-5301)
It was discovered that the Sieve plugin in Dovecot incorrectly handled
certain sieve scripts. An authenticated user could exploit this with a
crafted sieve script to cause a denial of service or possibly execute
arbitrary code. (CV
Red Hat
dovecot: incorrect handling of negative rights in the ACL plugin
vendor_redhat·2008-10-05·CVSS 7.5
CVE-2008-4577 [HIGH] dovecot: incorrect handling of negative rights in the ACL plugin
dovecot: incorrect handling of negative rights in the ACL plugin
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
Debian
CVE-2008-4577: dovecot - The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they ...
vendor_debian·2008·CVSS 7.5
CVE-2008-4577 [HIGH] CVE-2008-4577: dovecot - The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they ...
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
Scope: local
bookworm: resolved (fixed in 1:1.0.15-2.2)
bullseye: resolved (fixed in 1:1.0.15-2.2)
forky: resolved (fixed in 1:1.0.15-2.2)
sid: resolved (fixed in 1:1.0.15-2.2)
trixie: resolved (fixed in 1:1.0.15-2.2)
No detection rules found.
No public exploits indexed.
CWE
Incorrect Authorization
mitre_cwe
CWE-863 Incorrect Authorization
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Background: An access control list (ACL) represents who/what has permissions to a given object. Different operating systems implement (ACLs) in different ways. In UNIX, there are three types of permissions: read, write, and execute. Users are divided into three classes for file access: owner, group owner, and all other users where each class has a separate set of rights. In Windows NT, there are four basic types of permissions for files: "No access", "Read access", "Change access", and "Full control". Windows NT extends the concept of three types of users in UNIX to include a list of users and groups al
CWE
Improper Authorization
mitre_cwe
CWE-285 Improper Authorization
CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Background: An access control list (ACL) represents who/what has permissions to a given object. Different operating systems implement (ACLs) in different ways. In UNIX, there are three types of permissions: read, write, and execute. Users are divided into three classes for file access: owner, group owner, and all other users where each class has a separate set of rights. In Windows NT, there are four basic types of permissions for files: "No access", "Read access", "Change access", and "Full control". Windows NT extends the concept of three types of users in UNIX to include a list of users and groups along with their
CWE
Missing Authorization
mitre_cwe
CWE-862 Missing Authorization
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Background: An access control list (ACL) represents who/what has permissions to a given object. Different operating systems implement (ACLs) in different ways. In UNIX, there are three types of permissions: read, write, and execute. Users are divided into three classes for file access: owner, group owner, and all other users where each class has a separate set of rights. In Windows NT, there are four basic types of permissions for files: "No access", "Read access", "Change access", and "Full control". Windows NT extends the concept of three types of users in UNIX to include a list of users and groups along with their associated permissions.
http://bugs.gentoo.org/show_bug.cgi?id=240409http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlhttp://secunia.com/advisories/32164http://secunia.com/advisories/32471http://secunia.com/advisories/33149http://secunia.com/advisories/33624http://secunia.com/advisories/36904http://security.gentoo.org/glsa/glsa-200812-16.xmlhttp://www.dovecot.org/list/dovecot-news/2008-October/000085.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:232http://www.redhat.com/support/errata/RHSA-2009-0205.htmlhttp://www.securityfocus.com/bid/31587http://www.ubuntu.com/usn/USN-838-1http://www.vupen.com/english/advisories/2008/2745https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10376https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00816.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-October/msg00844.htmlhttp://bugs.gentoo.org/show_bug.cgi?id=240409http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlhttp://secunia.com/advisories/32164http://secunia.com/advisories/32471http://secunia.com/advisories/33149http://secunia.com/advisories/33624http://secunia.com/advisories/36904http://security.gentoo.org/glsa/glsa-200812-16.xmlhttp://www.dovecot.org/list/dovecot-news/2008-October/000085.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:232http://www.redhat.com/support/errata/RHSA-2009-0205.htmlhttp://www.securityfocus.com/bid/31587http://www.ubuntu.com/usn/USN-838-1http://www.vupen.com/english/advisories/2008/2745https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10376https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00816.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-October/msg00844.html
2008-10-15
Published