Stack-based buffer overflow in Cyrus IMAP Server 2.2.4 through 2.2.8, with the imapmagicplus option enabled, allows remote attackers to execute arbitrary code via a long (1) PROXY or (2) LOGIN command, a different vulnerability than CVE-2004-1015.

When the option imapmagicplus is activated on a server the PROXY and LOGIN commands suffer a standard stack overflow, because the username is not checked against a maximum length when it is copied into a temporary stack buffer. This bug is especially dangerous because it can be triggered before any kind of authentification took place.

The remote host is missing Security Update 2005-003. This security update contains security fixes for the following applications :

  - AFP Server
  - Bluetooth Setup Assistant
  - Core Foundation
  - Cyrus IMAP
  - Cyrus SASL
  - Folder Permissions
  - Mailman
  - Safari

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

The remote host is missing the patch for the advisory SUSE-SA:2004:043 (cyrus-imapd).


Stefan Esser reported various bugs within the Cyrus IMAP Server.
These include buffer overflows and out-of-bounds memory access which could allow remote attackers to execute arbitrary commands as root. The bugs occur in the pre-authentication phase, therefore an update is strongly recommended.

A number of vulnerabilities in the Cyrus-IMAP server were found by Stefan Esser. Due to insufficient checking within the argument parser of the 'partial' and 'fetch' commands, a buffer overflow could be exploited to execute arbitrary attacker-supplied code. Another exploitable buffer overflow could be triggered in situations when memory allocation files.

The provided packages have been patched to prevent these problems.

The remote host is affected by the vulnerability described in GLSA-200411-34 (Cyrus IMAP Server: Multiple remote vulnerabilities)

    Multiple vulnerabilities have been discovered in the argument     parsers of the 'partial' and 'fetch' commands of the Cyrus IMAP Server     (CAN-2004-1012, CAN-2004-1013). There are also buffer overflows in the     'imap magic plus' code that are vulnerable to exploitation as well     (CAN-2004-1011, CAN-2004-1015).
  Impact :

    An attacker can exploit these vulnerabilities to execute arbitrary     code with the rights of the user running the Cyrus IMAP Server.
  Workaround :

    There is no known workaround at this time.

According to its banner, the remote Cyrus IMAPD server is vulnerable to one pre-authentication buffer overflow, as well as three post- authentication buffer overflows. A remote attacker could exploit these issues to crash the server, or possibly execute arbitrary code.

ID	Name	Product	Family	Severity
19004	FreeBSD : Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow (816fdd8b-3d14-11d9-8818-008088034841)	Nessus	FreeBSD Local Security Checks	critical
17587	Mac OS X Multiple Vulnerabilities (Security Update 2005-003)	Nessus	MacOS X Local Security Checks	high
15923	SUSE-SA:2004:043: cyrus-imapd	Nessus	SuSE Local Security Checks	critical
15836	Mandrake Linux Security Advisory : cyrus-imapd (MDKSA-2004:139)	Nessus	Mandriva Local Security Checks	critical
15833	GLSA-200411-34 : Cyrus IMAP Server: Multiple remote vulnerabilities	Nessus	Gentoo Local Security Checks	critical
15819	Cyrus IMAP Server < 2.2.10 Multiple Remote Overflows	Nessus	Gain a shell remotely	high

Detections

Analytics

CVE-2004-1011

critical

Tenable Plugins

critical

high

critical

critical

critical

high