CVE-2009-3897

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-11-24 · updated 2026-06-16
Weakness: CWE-732

Description

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

Affected products

dovecot: from 1.2.0 before 1.2.8 — fixed in 1.2.8

How to fix

Upgrade to a fixed version: dovecot 1.2.8. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html
http://marc.info/?l=oss-security&m=125871729029145&w=2
http://marc.info/?l=oss-security&m=125881481222441&w=2
http://marc.info/?l=oss-security&m=125900267208712&w=2
http://marc.info/?l=oss-security&m=125900271508796&w=2
http://secunia.com/advisories/37443
http://www.dovecot.org/list/dovecot-news/2009-November/000143.html
http://www.mandriva.com/security/advisories?name=MDVSA-2009:306
http://www.osvdb.org/60316
http://www.securityfocus.com/bid/37084
http://www.vupen.com/english/advisories/2009/3306
https://exchange.xforce.ibmcloud.com/vulnerabilities/54363

Get alerted when CVE-2009-3897 or the next vulnerability affects your stack