CVE-2008-1199: dovecot Configuration

Vulnerability summary

CVE-2008-1199 is a medium (CVSS 4.4) Configuration vulnerability in dovecot. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.3% of scored vulnerabilities.

Timeline

1. 06-03-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.

• CWE-16ConfigurationWeaknesses in this category are typically introduced during the configuration of the software.
• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.