Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-4870 | First vendor Publication | 2008-10-31 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 2.1 | Attack Range | Local |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4870 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-732 | Incorrect Permission Assignment for Critical Resource (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10776 | |||
| Oval ID: | oval:org.mitre.oval:def:10776 | ||
| Title: | dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value. | ||
| Description: | dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-4870 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:21764 | |||
| Oval ID: | oval:org.mitre.oval:def:21764 | ||
| Title: | ELSA-2009:0205: dovecot security and bug fix update (Low) | ||
| Description: | dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:0205-02 CVE-2008-4577 CVE-2008-4870 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | dovecot |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29313 | |||
| Oval ID: | oval:org.mitre.oval:def:29313 | ||
| Title: | RHSA-2009:0205 -- dovecot security and bug fix update (Low) | ||
| Description: | An updated dovecot package that corrects two security flaws and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Dovecot is an IMAP server for Linux and UNIX-like systems, primarily written with security in mind. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:0205 CVE-2008-4577 CVE-2008-4870 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 | Product(s): | dovecot |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-06-05 | Name : Ubuntu USN-698-1 (nagios) File : nvt/ubuntu_698_1.nasl |
| 2009-01-26 | Name : RedHat Security Advisory RHSA-2009:0205 File : nvt/RHSA_2009_0205.nasl |
| 2008-12-29 | Name : Ubuntu USN-697-1 (imlib2) File : nvt/ubuntu_697_1.nasl |
| 2008-12-29 | Name : Ubuntu USN-698-2 (nagios3) File : nvt/ubuntu_698_2.nasl |
| 2008-12-29 | Name : Ubuntu USN-699-1 (blender) File : nvt/ubuntu_699_1.nasl |
| 2008-12-23 | Name : Gentoo Security Advisory GLSA 200812-16 (dovecot) File : nvt/glsa_200812_16.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 50253 | Dovecot dovecot.conf Permission Weakness Local ssl_key_password Parameter Dis... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20090120_dovecot_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2009-01-21 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2009-0205.nasl - Type : ACT_GATHER_INFO |
| 2008-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200812-16.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:13:06 |
|
| 2024-11-28 12:16:55 |
|
| 2022-02-04 12:06:28 |
|
| 2020-05-23 00:22:30 |
|
| 2017-09-29 09:23:47 |
|
| 2017-08-08 09:24:29 |
|
| 2016-06-29 00:02:04 |
|
| 2016-04-26 17:58:34 |
|
| 2014-02-17 10:47:08 |
|
| 2013-05-11 00:29:38 |
|
