NVD

Id
1159  
Name
CVE-2008-1199  
Description
Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-03-06  
Modified Date
2010-08-21  
Seq
2008-1199  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
7263 1159 CVE-2008-1199 SUSE-SR:2008:020  View
7264 1159 CVE-2008-1199 oval:org.mitre.oval:def:10739  View
7265 1159 CVE-2008-1199 GLSA-200803-25  View
7266 1159 CVE-2008-1199 DSA-1516  View
7267 1159 CVE-2008-1199 [Dovecot-news] 20080504 v1.0.11 released  View
7268 1159 CVE-2008-1199 RHSA-2008:0297  View
7269 1159 CVE-2008-1199 20080304 Dovecot mail_extra_groups setting is often used insecurely  View
7270 1159 CVE-2008-1199 28092  View
7271 1159 CVE-2008-1199 USN-593-1  View
7272 1159 CVE-2008-1199 dovecot-mailextragroups-unauth-access(41009)  View
7273 1159 CVE-2008-1199 FEDORA-2008-2464  View
7274 1159 CVE-2008-1199 FEDORA-2008-2475  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46074 JVNDB-2008-001384 Dovecot におけるシンボリックリンク攻撃を受ける脆弱性 Dovecot には、mail_extra_groups にて Dovecot に /var/mail への dotlocks 作成を許可している場合に、シンボリックリンク攻撃を受ける脆弱性が存在します。 CVE-2008-1199 31312 CVE-2008-1199 1159 4.1 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001384.html 2008-03-06 2008-06-17 View