CVE-2008-5301: Path Traversal

Published Dec 1, 2008

Updated

Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name.

Affected Software

21 affected components

Dovecot dovecot=0.99.13

Dovecot dovecot=0.99.14

Dovecot dovecot=1.0

Dovecot dovecot=1.0.2

Dovecot dovecot=1.0.3

Dovecot dovecot=1.0.4

Dovecot dovecot=1.0.5

Dovecot dovecot=1.0.6

Dovecot dovecot=1.0.7

Dovecot dovecot=1.0.8

Dovecot dovecot=1.0.9

Dovecot dovecot=1.0.10

Dovecot dovecot=1.0.12

Dovecot dovecot=1.1

Dovecot dovecot=1.1-rc2

Dovecot dovecot=1.1.0

Dovecot dovecot=1.1.1

Dovecot dovecot=1.1.2

Dovecot dovecot=1.1.3

Dovecot dovecot=1.1.4

Dovecot dovecot=1.1.5

Remediation

Patch Available

http://www.dovecot.org/list/dovecot/2008-November/035259.html

Event History

Dec 1, 2008

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-5301?

CVE-2008-5301 has a medium severity rating due to its ability to allow remote attackers to read and modify arbitrary .sieve files.

How do I fix CVE-2008-5301?

To fix CVE-2008-5301, upgrade to a patched version of Dovecot that addresses this directory traversal vulnerability.

Which versions of Dovecot are affected by CVE-2008-5301?

CVE-2008-5301 affects Dovecot versions 1.0.15, 1.1, and 1.2.

Can CVE-2008-5301 lead to further vulnerabilities?

Yes, if exploited, CVE-2008-5301 can lead to unauthorized access and modification of email processing scripts, potentially resulting in additional attacks.

Is there a workaround for CVE-2008-5301 if I cannot upgrade Dovecot?

A temporary workaround for CVE-2008-5301 is to restrict file access permissions to limit the ability to read or modify .sieve files.