CVE-2010-3706

Publication date 6 October 2010

Last updated 24 July 2024

Ubuntu priority

plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
dovecot	10.10 maverick	Fixed 1:1.2.12-1ubuntu8.1
	10.04 LTS lucid	Fixed 1:1.2.9-1ubuntu6.3
	9.10 karmic	Not affected
	9.04 jaunty	Ignored
	8.04 LTS hardy	Not affected
	6.06 LTS dapper	Not affected

Notes

mdeslaur

seems to be introduced by this: http://hg.dovecot.org/dovecot-1.2/rev/76ff6831c9ae

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
dovecot	Upstream: http://hg.dovecot.org/dovecot-1.2/rev/fd607e10e75d

CVE-2010-3706

Status

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references