Two security issues have been reported in Dovecot, which can be exploited by malicious users to bypass certain security restrictions.

1) The problem is that the ACL plugin interprets negative access rights as positive access rights, potentially giving an unprivileged user access to restricted resources.

2) An error in the ACL plugin when imposing mailbox creation restrictions can be exploited to create "parent/child/child" mailboxes.

The security issues are reported in versions prior to 1.1.4.

Solution
Update to version 1.1.4.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.dovecot.org/list/dovecot-news/2008-October/000085.html

Deep Links
Links available to Secunia VIM customers