漏洞信息详情

Dovecot ACL 插件 安全绕过漏洞

• CNNVD编号：CNNVD-200708-094
• 危害等级： 高危
  
• CVE编号： CVE-2007-4211
• 漏洞类型： 访问验证错误
• 发布时间： 2007-08-07
• 威胁类型： 远程
• 更新时间： 2009-04-08
• 厂        商： dovecot
• 漏洞来源： The vendor reporte...

漏洞简介

Dovecot 1.0.3版本之前的版本的ACL插件允许具有插入权的远程验证用户可以借助一个(1) 复本或 (2) APPEND 指令，存储某些标记符号。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Dovecot Dovecot 1.0.RC10

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0 beta8

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC11

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0 rc29

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC4

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC5

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC8

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.beta2

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC13

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC15

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC2

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC14

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.rc1

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC7

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC6

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC3

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0 beta7

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC9

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.beta3

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 1.0.RC12

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 0.99.13

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 0.99.13

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

Dovecot Dovecot 0.99.14

Dovecot dovecot-1.0.3.tar.gz

http://dovecot.org/releases/1.0/dovecot-1.0.3.tar.gz

参考网址

来源: BID

名称: 25182

链接:http://www.securityfocus.com/bid/25182

来源: XF

名称: dovecot-aclplugin-security-bypass(35767)

链接:http://xforce.iss.net/xforce/xfdb/35767

来源: REDHAT

名称: RHSA-2008:0297

链接:http://www.redhat.com/support/errata/RHSA-2008-0297.HTML

来源: MLIST

名称: [dovecot-news] 20070801 v1.0.3 released

链接:http://www.dovecot.org/list/dovecot-news/2007-August/000048.HTML

来源: SECUNIA

名称: 30342

链接:http://secunia.com/advisories/30342

来源: SECUNIA

名称: 26320

链接:http://secunia.com/advisories/26320

来源: issues.rpath.com

链接:https://issues.rpath.com/browse/RPL-1621

来源: SECUNIA

名称: 26475

链接:http://secunia.com/advisories/26475

受影响实体

• Dovecot Dovecot:1.0.2  

补丁

暂无