BugTraq
[ MDVSA-2008:232 ] dovecot Nov 19 2008 09:00PM
security mandriva com (1 replies)
Re: [ MDVSA-2008:232 ] dovecot Nov 19 2008 09:52PM
Eygene Ryabinkin (rea-sec codelabs ru)
Good day.

Wed, Nov 19, 2008 at 02:00:00PM -0700, security (at) mandriva (dot) com [email concealed] wrote:
> The ACL plugin in dovecot prior to version 1.1.6 allowed attackers to
> bypass intended access restrictions by using the 'k' right to create
> unauthorized 'parent/child/child' mailboxes (CVE-2008-4578).

Are you really sure that it should be 1.1.6? This bug is documented
in the 1.1.4 release notes,
http://www.dovecot.org/list/dovecot-news/2008-October/000085.html
and CVE entry speaks about 1.1.4 too.
--
Eygene

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus