Bugtraq mailing list archives
Re: [ MDVSA-2008:232 ] dovecot
From: Eygene Ryabinkin <rea-sec () codelabs ru>
Date: Thu, 20 Nov 2008 00:52:45 +0300
Good day. Wed, Nov 19, 2008 at 02:00:00PM -0700, security () mandriva com wrote:
The ACL plugin in dovecot prior to version 1.1.6 allowed attackers to bypass intended access restrictions by using the 'k' right to create unauthorized 'parent/child/child' mailboxes (CVE-2008-4578).
Are you really sure that it should be 1.1.6? This bug is documented in the 1.1.4 release notes, http://www.dovecot.org/list/dovecot-news/2008-October/000085.html and CVE entry speaks about 1.1.4 too. -- Eygene
Current thread:
- [ MDVSA-2008:232 ] dovecot security (Nov 19)
- Re: [ MDVSA-2008:232 ] dovecot Eygene Ryabinkin (Nov 19)