Dovecot 'script-login' Multiple Security Bypass Vulnerabilities

Bugtraq ID:	48003
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2011-2166 CVE-2011-2167
Remote:	Yes
Local:	No
Published:	May 26 2011 12:00AM
Updated:	Mar 11 2013 06:54AM
Credit:	Reported by the vendor.
Vulnerable:	Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Gentoo Linux Dovecot Dovecot 2.0.12 Dovecot Dovecot 2.0.4 Dovecot Dovecot 2.0.3 Dovecot Dovecot 2.0.2 Dovecot Dovecot 2.0.1 Dovecot Dovecot 2.0.5 Dovecot Dovecot 2.0.3 Dovecot Dovecot 2.0.2 Dovecot Dovecot 2.0.1 Dovecot Dovecot 2.0.0 Dovecot Dovecot 2.0 Beta1 Dovecot Dovecot 2.0 CentOS CentOS 6
Not Vulnerable:	Dovecot Dovecot 2.0.13

Dovecot 'script-login' Multiple Security Bypass Vulnerabilities

Dovecot is prone to multiple security-bypass vulnerabilities because it fails to properly implement certain configuration settings.

Authenticated attackers can exploit these issues to bypass certain security restrictions and perform unauthorized actions.

Dovecot 'script-login' Multiple Security Bypass Vulnerabilities

Attackers can use readily available tools to exploit these issues.

Dovecot 'script-login' Multiple Security Bypass Vulnerabilities

Solution:
Updates are available; please see the references for more information.

Dovecot 'script-login' Multiple Security Bypass Vulnerabilities

References:

• [Dovecot] v2.0.13 released (Timo Sirainen)
  
• Dovecot Homepage (Dovecot)