Description
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:1.1.9-1 | — |
| Debian 13 | dovecot | 1:1.1.9-1 | — |
| Debian 12 | dovecot | 1:1.1.9-1 | — |
References
- 32164 third-party-advisory
- dovecot-acl-mailbox-security-bypass(45669) vdb-entry
- 33149 third-party-advisory
- ADV-2008-2745 vdb-entry
- 31587 vdb-entry
- MDVSA-2008:232 vendor-advisory
- GLSA-200812-16 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=240409
- [Dovecot-news] 20081005 v1.1.4 released mailing-list
- 20081119 Re: [ MDVSA-2008:232 ] dovecot mailing-list