Dovecot Authentication Cache Security Bypass Vulnerability

Bugtraq ID:	27093
Class:	Access Validation Error
CVE:	CVE-2007-6598
Remote:	Yes
Local:	No
Published:	Dec 21 2007 12:00AM
Updated:	Oct 07 2008 05:48PM
Credit:	The vendor reported this issue.
Vulnerable:	Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 rPath rPath Linux 1 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux 5 server Dovecot Dovecot 1.0.9 Dovecot Dovecot 1.0.8 Dovecot Dovecot 1.0.7 Dovecot Dovecot 1.0.6 Dovecot Dovecot 1.0.5 Dovecot Dovecot 1.0.4 Dovecot Dovecot 1.0.3 Dovecot Dovecot 1.0.RC15 Dovecot Dovecot 1.0.RC14 Dovecot Dovecot 1.0.RC13 Dovecot Dovecot 1.0.RC12 Dovecot Dovecot 1.0.RC11 Dovecot Dovecot 1.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Dovecot Dovecot 1.0.10

Dovecot Authentication Cache Security Bypass Vulnerability

Dovecot is prone to a security-bypass vulnerability.

An attacker may exploit this condition to bypass certain security restrictions and obtain potentially sensitive data; other attacks are also possible.

Please note that default configurations of Dovecot are not affected by this issue. The chances of attack are further reduced because Dovecot must be configured in a specific way, making exploits highly circumstantial.

Versions higher than Dovecot 1.0.rc11 and prior to Dovecot 1.0.10 are vulnerable to this issue.

Dovecot Authentication Cache Security Bypass Vulnerability

An attacker can exploit this issue using standard client applications.

Dovecot Authentication Cache Security Bypass Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.


Dovecot Dovecot 1.0.RC11

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.RC15

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.RC14

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.RC12

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.RC13

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.3

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.4

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.5

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.6

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.7

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.8

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Dovecot 1.0.9

• Dovecot dovecot-1.0.10.tar.gz
  http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz

Dovecot Authentication Cache Security Bypass Vulnerability

References:

• [Dovecot-news] v1.0.10 released (Dovecot)
  
• Security hole #4: Specific LDAP + auth cache configuration may mix up user login (Dovecot)
  
• Vendor Homepage (Dovecot)
  
• RHSA-2008:0297-6 dovecot security and bug fix update (Red Hat)