CVE-2008-4870

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 01-11-2008 01:00

Last modified: - 03-02-2022 08:58

Total changes: - 2

Description

dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.

Common Vulnerability Scoring System (CVSS)

AV:L/AC:L/Au:N/C:P/I:N/A:N

Low

Attack complexity

Local

Attack vector

None

Availability

Low

Confidentiality

None

Integrity

Privileges required

Scope

User interaction

2.1

Base score

3.9

2.9

Exploitability score

Impact score

Verification logic

AND

vendor=dovecot AND product=dovecot AND version=1.0.7

vendor=Red Hat Enterprise Linux AND product=enterprise_linux AND version=5.0

Reference

https://bugzilla.redhat.com/show_bug.cgi?id=436287
[oss-security] 20081029 CVE Request (dovecot)-Mailing List, Third Party Advisory
GLSA-200812-16-Third Party Advisory
33149-Broken Link
RHSA-2009:0205-Third Party Advisory
32164-Broken Link
33624-Broken Link
dovecot-dovecot-information-disclosure(46323)-Third Party Advisory, VDB Entry
oval:org.mitre.oval:def:10776-Tool Signature

Keywords

CVE-2008-4870

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2008-4870

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures