Explain CVE-2008-1218
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.
Affected Products: n/a
References: [{'name': 'GLSA-200803-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200803-25.xml'}, {'name': '29295', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29295'}, {'name': 'dovecot-tab-authentication-bypass(41085)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41085'}, {'name': '5257', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5257'}, {'name': '29557', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29557'}, {'name': 'DSA-1516', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1516'}, {'tags': ['x_refsource_MISC'], 'url': 'http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0108'}, {'name': 'USN-593-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/593-1/'}, {'name': 'FEDORA-2008-2475', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00381.html'}, {'name': '29364', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29364'}, {'name': 'SUSE-SR:2008:020', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-2341'}, {'name': '[Dovecot-news] 20080309 Security hole #6: Some passdbs allowed users to log in without a valid password', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.dovecot.org/list/dovecot-news/2008-March/000064.html'}, {'name': '[Dovecot-news] 20080309 v1.0.13 and v1.1.rc3 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.dovecot.org/list/dovecot-news/2008-March/000065.html'}, {'name': '29226', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29226'}, {'name': '20080312 rPSA-2008-0108-1 dovecot', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489481/100/0/threaded'}, {'name': '32151', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32151'}, {'name': '29385', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29385'}, {'name': 'FEDORA-2008-2464', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00358.html'}, {'name': '28181', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28181'}, {'name': '29396', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29396'}]
CVE State: PUBLISHED