Details of VAR-201003-0202

ID

VAR-201003-0202

CVE

CVE-2010-0535

TITLE

Apple Mac OS X of Dovecot Vulnerable to access restrictions

Trust: 0.8

sources: JVNDB: JVNDB-2010-001253

DESCRIPTION

Dovecot in Apple Mac OS X 10.6 before 10.6.3, when Kerberos is enabled, does not properly enforce the service access control list (SACL) for sending and receiving e-mail, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors. Dovecot is prone to a security-bypass vulnerability. An authenticated attacker may perform unauthorized email actions. NOTE: This issue was previously covered in BID 39020 (Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities) but has been assigned its own record to better document it. Mac OS X is the operating system used by the Apple family of machines. Permissions and access control vulnerabilities exist in Dovecot for Apple Mac OS

Trust: 1.98

sources: NVD: CVE-2010-0535 // JVNDB: JVNDB-2010-001253 // BID: 39258 // VULHUB: VHN-43140

AFFECTED PRODUCTS

vendor:	apple	model:	mac os x	scope:	eq	version:	10.6.2	Trust: 1.6
vendor:	apple	model:	mac os x server	scope:	eq	version:	10.6.2	Trust: 1.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.6.1	Trust: 1.6
vendor:	apple	model:	mac os x server	scope:	eq	version:	10.6.1	Trust: 1.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.6.0	Trust: 1.6
vendor:	apple	model:	mac os x server	scope:	eq	version:	10.6.0	Trust: 1.6
vendor:	apple	model:	mac os x	scope:	eq	version:	v10.6 to v10.6.2	Trust: 0.8
vendor:	apple	model:	mac os x server	scope:	eq	version:	v10.6 to v10.6.2	Trust: 0.8
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.2.8	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.2.7	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.1.6	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.1.5	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.1.4	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.15	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.13	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.12	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.11	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.10	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.9	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.8	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.7	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.6	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.5	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.4	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0.3	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.2	Trust: 0.3
vendor:	dovecot	model:	1.1rc3	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.1rc2	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc9	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc8	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc7	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc6	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc5	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc4	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc3	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc2	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc15	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc14	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc13	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc12	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc11	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.rc10	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.beta3	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	1.0.beta2	scope:	-	version:	-	Trust: 0.3
vendor:	dovecot	model:	rc29	scope:	eq	version:	1.0	Trust: 0.3
vendor:	dovecot	model:	rc1	scope:	eq	version:	1.0	Trust: 0.3
vendor:	dovecot	model:	beta8	scope:	eq	version:	1.0	Trust: 0.3
vendor:	dovecot	model:	beta7	scope:	eq	version:	1.0	Trust: 0.3
vendor:	dovecot	model:	dovecot	scope:	eq	version:	1.0	Trust: 0.3
vendor:	apple	model:	mac os server	scope:	eq	version:	x10.6.2	Trust: 0.3
vendor:	apple	model:	mac os server	scope:	eq	version:	x10.6.1	Trust: 0.3
vendor:	apple	model:	mac os server	scope:	eq	version:	x10.6	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.6.2	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.6.1	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.6	Trust: 0.3
vendor:	apple	model:	mac os server	scope:	ne	version:	x10.6.3	Trust: 0.3
vendor:	apple	model:	mac os	scope:	ne	version:	x10.6.3	Trust: 0.3

sources: BID: 39258 // JVNDB: JVNDB-2010-001253 // CNNVD: CNNVD-201003-491 // NVD: CVE-2010-0535

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2010-0535
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2010-0535
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201003-491
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-43140
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2010-0535
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-43140
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-43140 // JVNDB: JVNDB-2010-001253 // CNNVD: CNNVD-201003-491 // NVD: CVE-2010-0535

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 1.9

sources: VULHUB: VHN-43140 // JVNDB: JVNDB-2010-001253 // NVD: CVE-2010-0535

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201003-491

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201003-491

CONFIGURATIONS

sources: JVNDB: JVNDB-2010-001253

PATCH

title:	HT4077	url:	http://support.apple.com/kb/HT4077	Trust: 0.8
title:	HT4077	url:	http://support.apple.com/kb/HT4077?viewlocale=ja_JP	Trust: 0.8

sources: JVNDB: JVNDB-2010-001253

EXTERNAL IDS

db:	NVD	id:	CVE-2010-0535	Trust: 2.8
db:	JVNDB	id:	JVNDB-2010-001253	Trust: 0.8
db:	CNNVD	id:	CNNVD-201003-491	Trust: 0.7
db:	NSFOCUS	id:	14715	Trust: 0.6
db:	APPLE	id:	APPLE-SA-2010-03-29-1	Trust: 0.6
db:	BID	id:	39258	Trust: 0.4
db:	VULHUB	id:	VHN-43140	Trust: 0.1

sources: VULHUB: VHN-43140 // BID: 39258 // JVNDB: JVNDB-2010-001253 // CNNVD: CNNVD-201003-491 // NVD: CVE-2010-0535

REFERENCES

url:	http://lists.apple.com/archives/security-announce/2010//mar/msg00001.html	Trust: 1.7
url:	http://support.apple.com/kb/ht4077	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0535	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0535	Trust: 0.8
url:	http://www.nsfocus.net/vulndb/14715	Trust: 0.6
url:	http://www.dovecot.org/	Trust: 0.3

sources: VULHUB: VHN-43140 // BID: 39258 // JVNDB: JVNDB-2010-001253 // CNNVD: CNNVD-201003-491 // NVD: CVE-2010-0535

CREDITS

Michael KisorDamian Put※ pucik@cc-team.org

Trust: 0.6

sources: CNNVD: CNNVD-201003-491

SOURCES

db:	VULHUB	id:	VHN-43140
db:	BID	id:	39258
db:	JVNDB	id:	JVNDB-2010-001253
db:	CNNVD	id:	CNNVD-201003-491
db:	NVD	id:	CVE-2010-0535

LAST UPDATE DATE

2024-11-23T19:59:16.542000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-43140	date:	2010-06-21T00:00:00
db:	BID	id:	39258	date:	2010-03-29T00:00:00
db:	JVNDB	id:	JVNDB-2010-001253	date:	2010-04-14T00:00:00
db:	CNNVD	id:	CNNVD-201003-491	date:	2010-04-01T00:00:00
db:	NVD	id:	CVE-2010-0535	date:	2024-11-21T01:12:23.907

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-43140	date:	2010-03-30T00:00:00
db:	BID	id:	39258	date:	2010-03-29T00:00:00
db:	JVNDB	id:	JVNDB-2010-001253	date:	2010-04-14T00:00:00
db:	CNNVD	id:	CNNVD-201003-491	date:	2010-03-30T00:00:00
db:	NVD	id:	CVE-2010-0535	date:	2010-03-30T18:30:01.407