Dovecot v1.2 security alert

[Spiral]

New advisory on Dovecot if it's relevant to anyone ...

Dovecot Insecure Directory Permissions Security Issue - Secunia Advisories - Vulnerability Information - Secunia.com

 

[BianchiDude]

Can anyone confirm or gainsay if this affects the dovecot version 1.1.19 that cpanel uses?

And if so when will a fix be available?

I ran upcp just now and still have version 1.1.19

TIA

 

[cPanelDon]

According to both the vendor and the third-party "secunia" link the issue only affects Dovecot releases in the version 1.2 series that were released prior to version 1.2.8; this does not affect the Dovecot version 1.1 series used by cPanel.

Reference: [Dovecot-news] v1.2.8 released

This is mainly to fix the 0777 base_dir creation issue, which could be considered a security hole, exploitable by local users. An attacker could for example replace Dovecot's auth socket and log in as other users. Gaining root privileges isn't possible though.

This affects only v1.2 users, v1.1 and older versions were creating the directory with 0755 permission.