5.8

CVE-2013-6171

checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dovecot ≫ Dovecot Version <= 2.2.6
Dovecot ≫ Dovecot Version 2.0 Update beta1
Dovecot ≫ Dovecot Version 2.0.0
Dovecot ≫ Dovecot Version 2.0.1
Dovecot ≫ Dovecot Version 2.0.2
Dovecot ≫ Dovecot Version 2.0.3
Dovecot ≫ Dovecot Version 2.0.4
Dovecot ≫ Dovecot Version 2.0.5
Dovecot ≫ Dovecot Version 2.0.6
Dovecot ≫ Dovecot Version 2.0.7
Dovecot ≫ Dovecot Version 2.0.8
Dovecot ≫ Dovecot Version 2.0.9
Dovecot ≫ Dovecot Version 2.0.10
Dovecot ≫ Dovecot Version 2.0.11
Dovecot ≫ Dovecot Version 2.0.12
Dovecot ≫ Dovecot Version 2.0.13
Dovecot ≫ Dovecot Version 2.0.14
Dovecot ≫ Dovecot Version 2.0.15
Dovecot ≫ Dovecot Version 2.1 Update rc1
Dovecot ≫ Dovecot Version 2.1 Update rc2
Dovecot ≫ Dovecot Version 2.1 Update rc3
Dovecot ≫ Dovecot Version 2.1 Update rc5
Dovecot ≫ Dovecot Version 2.1 Update rc6
Dovecot ≫ Dovecot Version 2.1 Update rc7
Dovecot ≫ Dovecot Version 2.1.0
Dovecot ≫ Dovecot Version 2.1.1
Dovecot ≫ Dovecot Version 2.1.2
Dovecot ≫ Dovecot Version 2.1.3
Dovecot ≫ Dovecot Version 2.1.4
Dovecot ≫ Dovecot Version 2.1.5
Dovecot ≫ Dovecot Version 2.1.6
Dovecot ≫ Dovecot Version 2.1.7
Dovecot ≫ Dovecot Version 2.1.10
Dovecot ≫ Dovecot Version 2.1.11
Dovecot ≫ Dovecot Version 2.1.12
Dovecot ≫ Dovecot Version 2.1.13
Dovecot ≫ Dovecot Version 2.1.14
Dovecot ≫ Dovecot Version 2.1.15
Dovecot ≫ Dovecot Version 2.2 Update rc1
Dovecot ≫ Dovecot Version 2.2 Update rc2
Dovecot ≫ Dovecot Version 2.2 Update rc3
Dovecot ≫ Dovecot Version 2.2 Update rc4
Dovecot ≫ Dovecot Version 2.2 Update rc5
Dovecot ≫ Dovecot Version 2.2 Update rc6
Dovecot ≫ Dovecot Version 2.2 Update rc7
Dovecot ≫ Dovecot Version 2.2.0
Dovecot ≫ Dovecot Version 2.2.1
Dovecot ≫ Dovecot Version 2.2.2
Dovecot ≫ Dovecot Version 2.2.3
Dovecot ≫ Dovecot Version 2.2.4
Dovecot ≫ Dovecot Version 2.2.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.46% 0.701
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://cpanel.net/tsr-2013-0010-full-disclosure/
http://secunia.com/advisories/54808
Vendor Advisory
http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security
http://www.dovecot.org/list/dovecot-news/2013-November/000264.html
Patch
https://usn.ubuntu.com/3556-2/