CVE-2008-4577

HIGH 7.5CVE-2008-4577 · Published 15/10/2008 · updated 16/06/2026

In short

CVE-2008-4577 is a HIGH (CVSS 7.5) vulnerability affecting dovecot (dovecot).
Chance of exploitation in the next 30 days (EPSS): 2.3%, higher than 83.5% of all vulnerabilities.
Fix: update to 1.1.4 or later.

Package	Affected versions	Patched versions
dovecot dovecot	`< 1.1.4`	`1.1.4`

Description

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

References

bugs.gentoo.org/show_bug.cgi · Issue Tracking
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Mailing List
secunia.com/advisories/32164 · Broken Link
secunia.com/advisories/32471 · Broken Link
secunia.com/advisories/33149 · Broken Link
secunia.com/advisories/33624 · Broken Link
secunia.com/advisories/36904 · Broken Link
security.gentoo.org/glsa/glsa-200812-16.xml · Third Party Advisory
dovecot.org/list/dovecot-news/2008-October/000085.html · Mailing List
mandriva.com/security/advisories · Broken Link
redhat.com/support/errata/RHSA-2009-0205.html · Broken Link
securityfocus.com/bid/31587 · Broken Link
ubuntu.com/usn/USN-838-1

More vulnerabilities in dovecot

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dovecot

< 1.1.4

1.1.4

More vulnerabilities in dovecot

See all →