CVE-2009-3897

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

• CWE-732

• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.htmlMailing List
• http://marc.info/?l=oss-security&m=125871729029145&w=2Mailing List, Patch
• http://marc.info/?l=oss-security&m=125881481222441&w=2Mailing List
• http://marc.info/?l=oss-security&m=125900267208712&w=2Mailing List, Patch
• http://marc.info/?l=oss-security&m=125900271508796&w=2Mailing List
• http://secunia.com/advisories/37443Broken Link, Vendor Advisory
• http://www.dovecot.org/list/dovecot-news/2009-November/000143.htmlMailing List, Patch, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:306Not Applicable
• http://www.osvdb.org/60316Broken Link
• http://www.securityfocus.com/bid/37084Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/3306Patch, Permissions Required, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54363Third Party Advisory, VDB Entry
• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.htmlMailing List
• http://marc.info/?l=oss-security&m=125871729029145&w=2Mailing List, Patch
• http://marc.info/?l=oss-security&m=125881481222441&w=2Mailing List
• http://marc.info/?l=oss-security&m=125900267208712&w=2Mailing List, Patch
• http://marc.info/?l=oss-security&m=125900271508796&w=2Mailing List
• http://secunia.com/advisories/37443Broken Link, Vendor Advisory
• http://www.dovecot.org/list/dovecot-news/2009-November/000143.htmlMailing List, Patch, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:306Not Applicable
• http://www.osvdb.org/60316Broken Link
• http://www.securityfocus.com/bid/37084Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/3306Patch, Permissions Required, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54363Third Party Advisory, VDB Entry

Published

Nov 24, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3891Cross-site scripting (XSS) vulnerability in wp-admin/press-t…
• CVE-2009-3892Cross-site scripting (XSS) vulnerability in Best Practical S…
• CVE-2009-3893Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2009-3894Multiple untrusted search path vulnerabilities in dstat befo…
• CVE-2009-3895Heap-based buffer overflow in the exif_entry_fix function (a…
• CVE-2009-3896src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 thro…
• CVE-2009-3898Directory traversal vulnerability in src/http/modules/ngx_ht…
• CVE-2009-3899Memory leak in the Sockets Direct Protocol (SDP) driver in S…
• CVE-2009-3900Unspecified vulnerability in the Cluster Management componen…
• CVE-2009-3901Multiple cross-site scripting (XSS) vulnerabilities in e-Cou…
• CVE-2009-3902Directory traversal vulnerability in Cherokee Web Server 0.5…
• CVE-2009-3903Multiple cross-site scripting (XSS) vulnerabilities in jspui…