Dovecot ACL Plugin Security Bypass Vulnerability

Bugtraq ID:	25182
Class:	Access Validation Error
CVE:	CVE-2007-4211
Remote:	Yes
Local:	No
Published:	Aug 02 2007 12:00AM
Updated:	May 21 2008 09:14PM
Credit:	The vendor reported this issue.
Vulnerable:	rPath rPath Linux 1 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux 5 server Dovecot Dovecot 0.99.14 Dovecot Dovecot 0.99.13 Dovecot Dovecot 0.99.13 Dovecot Dovecot 1.0.RC9 Dovecot Dovecot 1.0.RC8 Dovecot Dovecot 1.0.RC7 Dovecot Dovecot 1.0.RC6 Dovecot Dovecot 1.0.RC5 Dovecot Dovecot 1.0.RC4 Dovecot Dovecot 1.0.RC3 Dovecot Dovecot 1.0.RC2 Dovecot Dovecot 1.0.RC15 Dovecot Dovecot 1.0.RC14 Dovecot Dovecot 1.0.RC13 Dovecot Dovecot 1.0.RC12 Dovecot Dovecot 1.0.RC11 Dovecot Dovecot 1.0.RC10 Dovecot Dovecot 1.0.Beta3 Dovecot Dovecot 1.0.Beta2 Dovecot Dovecot 1.0 rc29 Dovecot Dovecot 1.0 Rc1 Dovecot Dovecot 1.0 Beta8 Dovecot Dovecot 1.0 Beta7 Dovecot Dovecot 1.0
Not Vulnerable:	Dovecot Dovecot 1.0.3

Dovecot ACL Plugin Security Bypass Vulnerability

Dovecot ACL plugin is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass mailbox restrictions and elevate privileges by altering ACL permission flags.

Versions prior to Dovecot 1.0.3 are vulnerable to this issue.

Dovecot ACL Plugin Security Bypass Vulnerability

An attacker with 'i' insert permission can exploit this issue by using 'APPEND' or 'COPY' commands on a mailbox.

Dovecot ACL Plugin Security Bypass Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.


Dovecot Dovecot 1.0.RC10

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0 Beta8

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC11

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0 rc29

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC4

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC5

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC8

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.Beta2

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC13

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC15

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC2

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC14

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0 Rc1

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC7

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC6

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC3

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0 Beta7

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC9

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.Beta3

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC12

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 0.99.13

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 0.99.13

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 0.99.14

• Dovecot dovecot-1.0.3.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot ACL Plugin Security Bypass Vulnerability

References:

• [Dovecot-news] v1.0.3 released (Dovecot)
  
• Vendor Homepage (Dovecot)
  
• RHSA-2008:0297-6 dovecot security and bug fix update (Red Hat)