CVEvulnerability

CVE-2008-1199

4.4 MEDIUM Published 2008-03-06 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-03-06
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-16, CWE-59

Description

Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.

Affected configurations

• dovecot dovecot 0.99.13 • dovecot dovecot 0.99.14 • dovecot dovecot 1.0 • dovecot dovecot 1.0.2 • dovecot dovecot 1.0.3 • dovecot dovecot 1.0.4 • dovecot dovecot 1.0.5 • dovecot dovecot 1.0.6 • dovecot dovecot 1.0.7 • dovecot dovecot 1.0.8 • dovecot dovecot 1.0.9 • dovecot dovecot 1.0.10 • dovecot dovecot 1.0.beta2 • dovecot dovecot 1.0.beta3 • dovecot dovecot 1.0.beta7 • dovecot dovecot 1.0.beta8 • dovecot dovecot 1.0.rc1 • dovecot dovecot 1.0.rc2 • dovecot dovecot 1.0.rc3 • dovecot dovecot 1.0.rc4 • dovecot dovecot 1.0.rc5 • dovecot dovecot 1.0.rc6 • dovecot dovecot 1.0.rc7 • dovecot dovecot 1.0.rc8 • dovecot dovecot 1.0.rc9 • dovecot dovecot 1.0.rc10 • dovecot dovecot 1.0.rc11 • dovecot dovecot 1.0.rc12 • dovecot dovecot 1.0.rc13 • dovecot dovecot 1.0.rc14 • dovecot dovecot 1.0.rc15 • dovecot dovecot 1.0 rc29

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References