CVE-2008-4577

Опубликовано: 15 окт. 2008

Источник: nvd

CVSS3: 7.5

CVSS2: 6.4

EPSS Низкий

Описание

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

Ссылки

http://bugs.gentoo.org/show_bug.cgi?id=240409
Issue Tracking
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
Mailing List
http://secunia.com/advisories/32164
Broken Link
Vendor Advisory
http://secunia.com/advisories/32471
Broken Link
http://secunia.com/advisories/33149
Broken Link
http://secunia.com/advisories/33624
Broken Link
http://secunia.com/advisories/36904
Broken Link
http://security.gentoo.org/glsa/glsa-200812-16.xml
Third Party Advisory
http://www.dovecot.org/list/dovecot-news/2008-October/000085.html
Mailing List
Release Notes
http://www.mandriva.com/security/advisories?name=MDVSA-2008:232
Broken Link
http://www.redhat.com/support/errata/RHSA-2009-0205.html
Broken Link
http://www.securityfocus.com/bid/31587
Broken Link
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-838-1
Third Party Advisory
http://www.vupen.com/english/advisories/2008/2745
Permissions Required
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10376
Broken Link
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00816.html
Mailing List
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00844.html
Mailing List
http://bugs.gentoo.org/show_bug.cgi?id=240409
Issue Tracking
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
Mailing List
http://secunia.com/advisories/32164
Broken Link
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*

Версия до 1.1.4 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:opensuse:opensuse:10.3-11.1:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01099

Низкий

7.5 High

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-863

Связанные уязвимости

CVE-2008-4577

CVSS3: 7.5

ubuntu

больше 16 лет назад

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

CVE-2008-4577

redhat

больше 16 лет назад

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

CVE-2008-4577

CVSS3: 7.5

debian

больше 16 лет назад

The ACL plugin in Dovecot before 1.1.4 treats negative access rights a ...

GHSA-24jq-h48j-g592

CVSS3: 7.5

github

около 3 лет назад

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

ELSA-2009-0205

oracle-oval

больше 16 лет назад

ELSA-2009-0205: dovecot security and bug fix update (LOW)

EPSS

Процентиль: 77%

0.01099

Низкий

7.5 High

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-863