CVE-2010-3706: Medium severity Dovecot dovecot vulnerability

Published Oct 6, 2010

Updated

plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.

Affected Software

20 affected components

Dovecot dovecot=1.2.2

Dovecot dovecot=1.2.7

Dovecot dovecot=1.2.4

Dovecot dovecot=1.2.9

Dovecot dovecot=1.2.11

Dovecot dovecot=1.2.1

Dovecot dovecot=1.2.13

Dovecot dovecot=1.2.8

Dovecot dovecot=1.2.6

Dovecot dovecot=1.2.5

Dovecot dovecot=1.2.10

Dovecot dovecot=1.2.14

Dovecot dovecot=1.2.3

Dovecot dovecot=1.2.0

Dovecot dovecot=1.2.12

Dovecot dovecot=2.0.4

Dovecot dovecot=2.0.2

Dovecot dovecot=2.0.1

Dovecot dovecot=2.0.3

Dovecot dovecot=2.0.0

Event History

Oct 6, 2010

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3706?

CVE-2010-3706 has a moderate severity rating due to the potential for privilege escalation in Dovecot.

How do I fix CVE-2010-3706?

To fix CVE-2010-3706, update Dovecot to version 1.2.15 or later, or 2.0.5 or later.

Which versions of Dovecot are affected by CVE-2010-3706?

CVE-2010-3706 affects Dovecot versions 1.2.0 through 1.2.14 and 2.0.0 through 2.0.4.

What kind of vulnerability is CVE-2010-3706?

CVE-2010-3706 is a vulnerability related to Access Control Lists (ACL) mismanagement.

Is it safe to use Dovecot versions before 1.2.15 due to CVE-2010-3706?

Using Dovecot versions before 1.2.15 is not safe as they are vulnerable to CVE-2010-3706.