Off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote attackers to execute arbitrary code via the username.

Recently another buffer overflow has been discovered in the SASL authentication module of the Cyrus IMAP server. An off-by-one comparison error in the mysasl_canon_user() function could lead to a missing termination of an user name string.

This vulnerability could allow remote, attacker-supplied machine code to be executed in the context of the affected server process. Since the IMAP server usually runs as unprivileged user 'cyrus', there is no possibility of root privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is missing Security Update 2005-003. This security update contains security fixes for the following applications :

  - AFP Server
  - Bluetooth Setup Assistant
  - Core Foundation
  - Cyrus IMAP
  - Cyrus SASL
  - Folder Permissions
  - Mailman
  - Safari

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

According to its banner, the remote Cyrus IMAPD server is vulnerable to a pre-login buffer overflow. Cyrus IMAP server is also vulnerable to three other buffer overflows after authentication. An attacker with or without a valid login could exploit these issues, and would be able to execute arbitrary commands as the owner of the Cyrus process.

According to its banner, the remote Cyrus IMAPD server is vulnerable to one pre-authentication buffer overflow, as well as three post- authentication buffer overflows. A remote attacker could exploit these issues to crash the server, or possibly execute arbitrary code.

ID	Name	Product	Family	Severity
20653	Ubuntu 4.10 : cyrus21-imapd vulnerability (USN-37-1)	Nessus	Ubuntu Local Security Checks	critical
17587	Mac OS X Multiple Vulnerabilities (Security Update 2005-003)	Nessus	MacOS X Local Security Checks	high
2425	Cyrus IMAPD < 2.2.10 Multiple Vulnerabilities	Nessus Network Monitor	IMAP Servers	high
15819	Cyrus IMAP Server < 2.2.10 Multiple Remote Overflows	Nessus	Gain a shell remotely	high

Detections

Analytics

CVE-2004-1067

critical

Tenable Plugins

critical

high

high

high