Dovecot v1.2 security alert

BianchiDude

Well-Known Member
PartnerNOC
Jul 2, 2005
617
0
166
Can anyone confirm or gainsay if this affects the dovecot version 1.1.19 that cpanel uses?

And if so when will a fix be available?

I ran upcp just now and still have version 1.1.19

TIA
 

cPanelDon

cPanel Quality Assurance Analyst
Staff member
Nov 5, 2008
2,545
12
268
Houston, Texas, U.S.A.
cPanel Access Level
DataCenter Provider
Twitter
According to both the vendor and the third-party "secunia" link the issue only affects Dovecot releases in the version 1.2 series that were released prior to version 1.2.8; this does not affect the Dovecot version 1.1 series used by cPanel.

Reference: [Dovecot-news] v1.2.8 released
This is mainly to fix the 0777 base_dir creation issue, which could be considered a security hole, exploitable by local users. An attacker could for example replace Dovecot's auth socket and log in as other users. Gaining root privileges isn't possible though.

This affects only v1.2 users, v1.1 and older versions were creating the directory with 0755 permission.