Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via (1) an off-by-one error in the imapd annotate extension, (2) an off-by-one error in "cached header handling," (3) a stack-based buffer overflow in fetchnews, or (4) a stack-based buffer overflow in imapd.

Several buffer overflow bugs were found in cyrus-imapd. It is possible that an authenticated malicious user could cause the imap server to crash. Additionally, a peer news admin could potentially execute arbitrary code on the imap server when news is received using the fetchnews command. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0546 to this issue.

In addition this version of the rpm contains a collection of other fixes since the last FC3 update (see below changelog).

>>>>>>>>>>>><i> IMPORTANT NOTE FOR X86_64 INSTALLATION <<<<<<<<<<<< </I> This rpm also fixes bug #156121 that incorrectly placed some executables /usr/lib64/cyrus-imapd. /usr/lib64 is reserved for 64 bit libraries and this caused problems for existing scripts that expected to find them in a canonical location (/usr/lib/cyrus-imapd) and violated the multilib packaging guidelines. Only references external to the cyrus-imapd package are affected by this, the rpm is self consistent. The most notable example is /usr/lib64/cyrus-impad/deliver which is now /usr/lib/cyrus-imapd/deliver (use of lmtp is encouraged in preference to deliver). This change only affects x86_64 installations.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated cyrus-imapd packages that fix several buffer overflow security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The cyrus-imapd package contains the core of the Cyrus IMAP server.

Several buffer overflow bugs were found in cyrus-imapd. It is possible that an authenticated malicious user could cause the imap server to crash. Additionally, a peer news admin could potentially execute arbitrary code on the imap server when news is received using the fetchnews command. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0546 to this issue.

Users of cyrus-imapd are advised to upgrade to these updated packages, which contain cyrus-imapd version 2.2.12 to correct these issues.

Sean Larsson discovered a buffer overflow in the IMAP 'annotate' extension. This possibly allowed an authenticated IMAP client to execute arbitrary code with the privileges of the Cyrus IMAP server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Cyrus IMAP Server ChangeLog states :

- Fix possible single byte overflow in mailbox handling code.

- Fix possible single byte overflows in the imapd annotate extension.

- Fix stack-based buffer overflows in fetchnews (exploitable by peer news server), backend (exploitable by admin), and in imapd (exploitable by users though only on platforms where a filename may be larger than a mailbox name).

The 2.1.X series are reportedly only affected by the second issue.

These issues may lead to execution of arbitrary code with the permissions of the user running the Cyrus IMAP Server.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:408 advisory.

  - security flaw (CVE-2005-0546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several overruns have been fixed in the IMAP annote extension as well as in cached header handling which can be run by an authenticated user. As well, additional bounds checking in fetchnews was improved to avoid exploitation by a peer news admin.

According to its banner, the remote Cyrus IMAPD server is vulnerable to multiple remote buffer overflow attacks.  An attacker exploiting these flaws would need to be able to communicate with the IMAPD server (usually on TCP port 143).  A successful attack would result in the attacker executing arbitrary code on the IMAPD server.

According to its banner, the remote Cyrus IMAP server is affected by off-by-one errors in its imapd annotate extension and its cached header handling which can be triggered by an authenticated user, a buffer overflow in fetchnews that can be triggered by a peer news admin, and an unspecified stack-based buffer overflow in imapd.

The remote host is affected by the vulnerability described in GLSA-200502-29 (Cyrus IMAP Server: Multiple overflow vulnerabilities)

    Possible single byte overflows have been found in the imapd annotate     extension and mailbox handling code. Furthermore stack-based buffer overflows     have been found in fetchnews, the backend and imapd.
  Impact :

    An attacker, who could be an authenticated user or an admin of a     peering news server, could exploit these vulnerabilities to execute     arbitrary code with the rights of the user running the Cyrus IMAP     Server.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
62256	Fedora Core 3 : cyrus-imapd-2.2.12-1.1.fc3 (2005-339)	Nessus	Fedora Local Security Checks	high
21935	CentOS 4 : cyrus-imapd (CESA-2005:408)	Nessus	CentOS Local Security Checks	high
20712	Ubuntu 4.10 : cyrus21-imapd vulnerability (USN-87-1)	Nessus	Ubuntu Local Security Checks	high
19086	FreeBSD : cyrus-imapd -- multiple buffer overflow vulnerabilities (b2d248ad-88f6-11d9-aa18-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
18280	RHEL 4 : cyrus-imapd (RHSA-2005:408)	Nessus	Red Hat Local Security Checks	critical
17280	Mandrake Linux Security Advisory : cyrus-imapd (MDKSA-2005:051)	Nessus	Mandriva Local Security Checks	high
2645	Cyrus IMAPD < 2.2.12 Multiple Remote Overflows	Nessus Network Monitor	IMAP Servers	high
17208	Cyrus IMAP Server < 2.2.11 Multiple Remote Overflows	Nessus	Gain a shell remotely	high
17206	GLSA-200502-29 : Cyrus IMAP Server: Multiple overflow vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-0546

critical

Tenable Plugins

high

high

high

high

critical

high

high

high

high