CVE-2009-3897 — Incorrect Permission Assignment in Dovecot

CWE-732 — Incorrect Permission Assignment7 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 75.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
DovecotDebian Dovecot
Timeline
PublishedNov 24
Latest updateMay 2

Description

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/dovecot< dovecot 1:1.2.8-1 (bookworm)
▶NVDdovecot/dovecot1.2.0 — 1.2.8
▶Debiandovecot/dovecot< 1:1.2.8-1+3

Patches

Patch: marc.info ↗Patch: marc.info ↗Patch: www.dovecot.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-89r5-2fhc-hwj7: Dovecot 1↗2022-05-02
▶
OSV
CVE-2009-3897: Dovecot 1↗2009-11-24
▶

📋Vendor Advisories

2
Red Hat
dovecot: Insecure permissions set for certain directories at installation time↗2009-11-20
▶
Debian
CVE-2009-3897: dovecot - Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain dire...↗2009
▶

📐Framework References

1
CWE
Incorrect Permission Assignment for Critical Resource↗
▶

💬Community

1
Bugzilla
CVE-2009-3897 dovecot: Insecure permissions set for certain directories at installation time↗2011-10-14
▶