CVE-2008-4870
Published: 1 November 2008
dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.
Notes
| Author | Note |
|---|---|
| jdstrand | marking as low because the default configuration doesn't set ssl_key_password |
| mdeslaur | file permissions can't be changed because of "deliver" Red Hat backported a new "!include_try" directive to the config file that allows including a second permission-protected config file (taken from 1.1.7) Debian says "by default this file doesnt containt sensitive information and administrator changing this should ensure on its own that the mode is secure" after discussion with kees and jdstrand, here's our plan: TODO: add a warning to the default conf file. on second thought, not worth risking a conf file prompt, so marking as ignored |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
dovecot Launchpad, Ubuntu, Debian |
dapper |
Ignored
|
| gutsy |
Ignored
(end of life, was needed)
|
|
| hardy |
Ignored
|
|
| intrepid |
Ignored
(end of life, was needed)
|
|
| jaunty |
Not vulnerable
(1:1.1.11-0ubuntu2)
|
|
| karmic |
Not vulnerable
(1:1.1.11-0ubuntu2)
|
|
| lucid |
Not vulnerable
(1:1.1.11-0ubuntu2)
|
|
| upstream |
Released
(1.1.7)
|