NVD Vulnerability Detail

CVE-2010-3304

Summary	The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
Publication Date	Sept. 25, 2010, 4 a.m.
Registration Date	Jan. 29, 2021, 11:05 a.m.
Last Update	Nov. 21, 2024, 10:18 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
2	http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
3	http://secunia.com/advisories/43220
4	http://secunia.com/advisories/43220
5	http://www.dovecot.org/list/dovecot-news/2010-July/000163.html	Patch Vendor Advisory
6	http://www.dovecot.org/list/dovecot-news/2010-July/000163.html	Patch Vendor Advisory
7	http://www.mandriva.com/security/advisories?name=MDVSA-2010:217
8	http://www.mandriva.com/security/advisories?name=MDVSA-2010:217
9	http://www.openwall.com/lists/oss-security/2010/09/16/14
10	http://www.openwall.com/lists/oss-security/2010/09/16/14
11	http://www.openwall.com/lists/oss-security/2010/09/16/17
12	http://www.openwall.com/lists/oss-security/2010/09/16/17
13	http://www.securityfocus.com/bid/41964
14	http://www.securityfocus.com/bid/41964
15	http://www.ubuntu.com/usn/USN-1059-1
16	http://www.ubuntu.com/usn/USN-1059-1
17	http://www.vupen.com/english/advisories/2010/2840
18	http://www.vupen.com/english/advisories/2010/2840
19	http://www.vupen.com/english/advisories/2011/0301
20	http://www.vupen.com/english/advisories/2011/0301

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Dovecot の ACL プラグインにおけるメールボックスを読まれる脆弱性

Title	Dovecot の ACL プラグインにおけるメールボックスを読まれる脆弱性
Summary	Dovecot の ACL プラグインには、新規に作成されたメールボックスに INBOX ACLS 情報を伝播するため、脆弱な ACL を有するメールボックスを読まれる脆弱性が存在します。
Possible impacts	第三者により、脆弱な ACL を有するメールボックスを読まれる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 24, 2010, midnight
Registration Date	July 4, 2011, 8:32 a.m.
Last Update	July 4, 2011, 8:32 a.m.

Affected System

ターボリナックス

Turbolinux Appliance Server 3.0

Turbolinux Appliance Server 3.0 (x64)

Turbolinux Server 11

Turbolinux Server 11 (x64)

Timo Sirainen

Dovecot 1.2.13 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-3304	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3304
National Vulnerability Database (NVD)
2	CVE-2010-3304	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3304

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
dovecot
1	v1.2.13 released	http://www.dovecot.org/list/dovecot-news/2010-July/000163.html
Turbolinux Security Advisory
2	TLSA-2011-18	http://www.turbolinux.co.jp/security/2011/TLSA-2011-18j.txt

その他

No	Name	URL
Secunia Advisory
1	SA40723	http://secunia.com/advisories/40723
SecurityFocus
2	41964	http://www.securityfocus.com/bid/41964

Change Log

No	Changed Details	Date of change
0	[2011年07月04日] 掲載	Feb. 17, 2018, 10:37 a.m.