CVE-2008-1218

Dovecot <1.0.13, <1.1.rc3 - Command Injection

Title source: llm
STIX 2.1

Description

Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.

Exploits (1)

exploitdb WORKING POC VERIFIED
by kingcope · pythonremotemultiple
https://www.exploit-db.com/exploits/5257

References (21)

Core 21
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200803-25.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29295
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41085
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/5257
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29557
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1516
Third Party Advisory x_refsource_misc
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0108
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/593-1/
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29364
Issue Tracking x_refsource_confirm
https://issues.rpath.com/browse/RPL-2341
Various Sources mailing-list x_refsource_mlist
http://www.dovecot.org/list/dovecot-news/2008-March/000064.html
Various Sources mailing-list x_refsource_mlist
http://www.dovecot.org/list/dovecot-news/2008-March/000065.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29226
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/489481/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32151
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29385
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28181
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29396

Scores

EPSS 0.1873
EPSS Percentile 95.3%

Details

CWE
CWE-255
Status published
Products (2)
dovecot/dovecot < 1.0.12
dovecot/dovecot < 1.1
Published Mar 10, 2008
Tracked Since Feb 18, 2026