Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.

From Red Hat Security Advisory 2009:1459 :

Updated cyrus-imapd packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support.

Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve implementation. An authenticated user able to create Sieve mail filtering rules could use these flaws to execute arbitrary code with the privileges of the Cyrus IMAP server user. (CVE-2009-2632, CVE-2009-3235)

Users of cyrus-imapd are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the update, cyrus-imapd will be restarted automatically.

CVE-2009-2632 cyrus-imapd: buffer overflow in cyrus sieve

CVE-2009-3235 cyrus-impad: CMU sieve buffer overflows

Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve implementation. An authenticated user able to create Sieve mail filtering rules could use these flaws to execute arbitrary code with the privileges of the Cyrus IMAP server user. (CVE-2009-2632, CVE-2009-3235)

After installing the update, cyrus-imapd will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201110-16 (Cyrus IMAP Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Cyrus IMAP Server.
      Please review the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated local or remote attacker may be able to execute       arbitrary code with the privileges of the Cyrus IMAP Server process or       cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

It was discovered that the SIEVE component of cyrus-imapd and kolab-cyrus-imapd, the Cyrus mail system, is vulnerable to a buffer overflow when processing SIEVE scripts. This can be used to elevate privileges to the cyrus system user. An attacker who is able to install SIEVE scripts executed by the server is therefore able to read and modify arbitrary email messages on the system. The update introduced by DSA 1881-1 was incomplete and the issue has been given an additional CVE id due to its complexity.

It was discovered that the SIEVE component of dovecot, a mail server that supports mbox and maildir mailboxes, is vulnerable to a buffer overflow when processing SIEVE scripts. This can be used to elevate privileges to the dovecot system user. An attacker who is able to install SIEVE scripts executed by the server is therefore able to read and modify arbitrary email messages on the system.

It was discovered that the SIEVE component of cyrus-imapd, a highly scalable enterprise mail system, is vulnerable to a buffer overflow when processing SIEVE scripts. Due to incorrect use of the sizeof() operator an attacker is able to pass a negative length to snprintf() calls resulting in large positive values due to integer conversion.
This causes a buffer overflow which can be used to elevate privileges to the cyrus system user. An attacker who is able to install SIEVE scripts executed by the server is therefore able to read and modify arbitrary email messages on the system.

Updated cyrus-imapd packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support.

Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve implementation. An authenticated user able to create Sieve mail filtering rules could use these flaws to execute arbitrary code with the privileges of the Cyrus IMAP server user. (CVE-2009-2632, CVE-2009-3235)

Users of cyrus-imapd are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the update, cyrus-imapd will be restarted automatically.

This update of dovecot fixes two buffer overflows in the sieve plug-in (CVE-2009-2632, CVE-2009-3235)

This update of cyrus-imapd fixes a buffer overflow that occurs in snprintf() due to incorrectly calculating the size of the destination buffer. (CVE-2009-2632)

It was discovered that the ACL plugin in Dovecot would incorrectly handle negative access rights. An attacker could exploit this flaw to access the Dovecot server, bypassing the intended access restrictions.
This only affected Ubuntu 8.04 LTS. (CVE-2008-4577)

It was discovered that the ManageSieve service in Dovecot incorrectly handled '..' in script names. A remote attacker could exploit this to read and modify arbitrary sieve files on the server. This only affected Ubuntu 8.10. (CVE-2008-5301)

It was discovered that the Sieve plugin in Dovecot incorrectly handled certain sieve scripts. An authenticated user could exploit this with a crafted sieve script to cause a denial of service or possibly execute arbitrary code. (CVE-2009-2632, CVE-2009-3235).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dovecot-sieve updated to 1.1.7 It is derived from CMU sieve used by cyrus- imapd and was affected by CVE-2009-2632 too. See upstream announcement for further details: http://dovecot.org/list/dovecot- news/2009-September/000135.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in cyrus-imapd :

Buffer overflow in the SIEVE script component (sieve/script.c) in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14 allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error (CVE-2009-2632).

This update provides a solution to this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The Cyrus IMAP Server ChangeLog states :

Fixed CERT VU#336053 - Potential buffer overflow in Sieve.

ID	Name	Product	Family	Severity
67930	Oracle Linux 4 / 5 : cyrus-imapd (ELSA-2009-1459)	Nessus	Oracle Linux Local Security Checks	high
60669	Scientific Linux Security Update : cyrus-imapd on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
56591	GLSA-201110-16 : Cyrus IMAP Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
44758	Debian DSA-1893-1 : cyrus-imapd-2.2 kolab-cyrus-imapd - buffer overflow	Nessus	Debian Local Security Checks	high
44757	Debian DSA-1892-1 : dovecot - buffer overflow	Nessus	Debian Local Security Checks	high
44746	Debian DSA-1881-1 : cyrus-imapd-2.2 - buffer overflow	Nessus	Debian Local Security Checks	medium
43795	CentOS 4 / 5 : cyrus-imapd (CESA-2009:1459)	Nessus	CentOS Local Security Checks	high
42104	openSUSE 10 Security Update : dovecot (dovecot-6539)	Nessus	SuSE Local Security Checks	high
42103	openSUSE Security Update : dovecot (dovecot-1366)	Nessus	SuSE Local Security Checks	high
42102	openSUSE Security Update : dovecot (dovecot-1366)	Nessus	SuSE Local Security Checks	high
41995	openSUSE 10 Security Update : cyrus-imapd (cyrus-imapd-6483)	Nessus	SuSE Local Security Checks	medium
41940	Ubuntu 8.04 LTS / 8.10 / 9.04 : dovecot vulnerabilities (USN-838-1)	Nessus	Ubuntu Local Security Checks	high
41065	RHEL 4 / 5 : cyrus-imapd (RHSA-2009:1459)	Nessus	Red Hat Local Security Checks	high
41040	openSUSE Security Update : cyrus-imapd (cyrus-imapd-1286)	Nessus	SuSE Local Security Checks	medium
41034	openSUSE Security Update : cyrus-imapd (cyrus-imapd-1286)	Nessus	SuSE Local Security Checks	medium
40992	Fedora 10 : dovecot-1.1.18-2.fc10 (2009-9559)	Nessus	Fedora Local Security Checks	high
40965	Mandriva Linux Security Advisory : cyrus-imapd (MDVSA-2009:229-1)	Nessus	Mandriva Local Security Checks	medium
40910	FreeBSD : cyrus-imapd -- Potential buffer overflow in Sieve (012b495c-9d51-11de-8d20-001bd3385381)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2009-2632

critical

Tenable Plugins

high

high

high

critical

high

high

medium

high

high

high

high

medium

high

high

medium

medium

high

medium

medium