What’s Vulnerable › Vulnerabilities

CVE-2008-4577

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2008-10-15 · updated 2026-06-16
• Weakness: CWE-863

Description

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

Affected products

• Canonical Ubuntu Linux: 8.04, 8.10, 9.04
• dovecot: before 1.1.4 — fixed in 1.1.4
• Fedoraproject Fedora: 8, 9
• Opensuse: 10.3-11.1

How to fix

Upgrade to a fixed version: dovecot 1.1.4. Check the vendor advisory for mitigations.

References

• http://bugs.gentoo.org/show_bug.cgi?id=240409
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
• http://secunia.com/advisories/32164
• http://secunia.com/advisories/32471
• http://secunia.com/advisories/33149
• http://secunia.com/advisories/33624
• http://secunia.com/advisories/36904
• http://security.gentoo.org/glsa/glsa-200812-16.xml
• http://www.dovecot.org/list/dovecot-news/2008-October/000085.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:232
• http://www.redhat.com/support/errata/RHSA-2009-0205.html
• http://www.securityfocus.com/bid/31587

Get alerted when CVE-2008-4577 or the next vulnerability affects your stack