The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1771 advisory.

  - cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name     (CVE-2019-11356)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4566-1 advisory.

  - The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote     attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar     property name. (CVE-2019-11356)

  - An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If     sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user     with a mail account on the service can use a sieve script containing a fileinto directive to create any     mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in     imap/lmtp_sieve.c. (CVE-2019-19783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2019:1771 :

An update for cyrus-imapd is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support.

Security Fix(es) :

* cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name (CVE-2019-11356)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1771 advisory.

  - cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name     (CVE-2019-11356)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to version 3.0.10, which fixes a security issue (a buffer overrun vulnerability in the httpd daemon, CVE-2019-11356).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in the CalDAV feature in httpd of the Cyrus IMAP server, leading to denial of service or potentially the execution of arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Cyrus IMAP 3.0.10 Release Notes states :

Fixed CVE-2019-11356: buffer overrun in httpd

ID	Name	Product	Family	Severity
145588	CentOS 8 : cyrus-imapd (CESA-2019:1771)	Nessus	CentOS Local Security Checks	critical
141178	Ubuntu 18.04 LTS : Cyrus IMAP Server vulnerabilities (USN-4566-1)	Nessus	Ubuntu Local Security Checks	critical
127599	Oracle Linux 8 : cyrus-imapd (ELSA-2019-1771)	Nessus	Oracle Linux Local Security Checks	critical
126709	RHEL 8 : cyrus-imapd (RHSA-2019:1771)	Nessus	Red Hat Local Security Checks	critical
125789	Fedora 29 : cyrus-imapd (2019-f0435555ac)	Nessus	Fedora Local Security Checks	critical
125784	Debian DSA-4458-1 : cyrus-imapd - security update	Nessus	Debian Local Security Checks	critical
125744	Fedora 30 : cyrus-imapd (2019-309f559057)	Nessus	Fedora Local Security Checks	critical
125437	FreeBSD : cyrus-imapd -- buffer overrun in httpd (10fd731c-8088-11e9-b6ae-001871ec5271)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-11356

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical