Stefan Esser discovered several security related problems in the Cyrus IMAP daemon. Due to a bug in the command parser it is possible to access memory beyond the allocated buffer in two places which could lead to the execution of arbitrary code.

The remote host is missing Security Update 2005-003. This security update contains security fixes for the following applications :

  - AFP Server
  - Bluetooth Setup Assistant
  - Core Foundation
  - Cyrus IMAP
  - Cyrus SASL
  - Folder Permissions
  - Mailman
  - Safari

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

According to its banner, the remote Cyrus IMAPD server is vulnerable to one pre-authentication buffer overflow, as well as three post- authentication buffer overflows. A remote attacker could exploit these issues to crash the server, or possibly execute arbitrary code.

バナーによると、リモートのCyrus IMAPDサーバーは、1つの認証前バッファオーバーフローと3つの認証後バッファオーバーフローに対して脆弱です。リモートの攻撃者は、これらの問題を悪用し、サーバーをクラッシュさせるか、あるいは任意のコードを実行する可能性があります。

The remote host is affected by the vulnerability described in GLSA-200411-34 (Cyrus IMAP Server: Multiple remote vulnerabilities)

    Multiple vulnerabilities have been discovered in the argument     parsers of the 'partial' and 'fetch' commands of the Cyrus IMAP Server     (CAN-2004-1012, CAN-2004-1013). There are also buffer overflows in the     'imap magic plus' code that are vulnerable to exploitation as well     (CAN-2004-1011, CAN-2004-1015).
  Impact :

    An attacker can exploit these vulnerabilities to execute arbitrary     code with the rights of the user running the Cyrus IMAP Server.
  Workaround :

    There is no known workaround at this time.

A number of vulnerabilities in the Cyrus-IMAP server were found by Stefan Esser. Due to insufficient checking within the argument parser of the 'partial' and 'fetch' commands, a buffer overflow could be exploited to execute arbitrary attacker-supplied code. Another exploitable buffer overflow could be triggered in situations when memory allocation files.

The provided packages have been patched to prevent these problems.

根據標題來判斷，遠端 Cyrus IMAPD 伺服器容易受到一個驗證前緩衝區溢位弱點影響，以及三個驗證後緩衝區溢位弱點影響。遠端攻擊者可利用這些弱點來造成服務損毀，或可能執行任意程式碼。

根据其标题，远程 Cyrus IMAPD 服务器容易受到一个身份验证前缓冲区溢出漏洞和三个身份验证后缓冲区溢出漏洞的影响。远程攻击者可利用这些问题导致服务器崩溃，或可能执行任意代码。

Due to a bug within the argument parser of the partial command an argument like 'body[p' will be wrongly detected as 'body.peek'.
Because of this the bufferposition gets increased by 10 instead of 5 and could therefore point outside the allocated memory buffer for the rest of the parsing process. In imapd versions prior to 2.2.7 the handling of 'body' or 'bodypeek' arguments was broken so that the terminating ']' got overwritten by a '\0'. Combined the two problems allow a potential attacker to overwrite a single byte of malloc() control structures, which leads to remote code execution if the attacker successfully controls the heap layout.

The remote host is missing the patch for the advisory SUSE-SA:2004:043 (cyrus-imapd).


Stefan Esser reported various bugs within the Cyrus IMAP Server.
These include buffer overflows and out-of-bounds memory access which could allow remote attackers to execute arbitrary commands as root. The bugs occur in the pre-authentication phase, therefore an update is strongly recommended.

Stefan Esser discovered several buffer overflows in the Cyrus IMAP server. Due to insufficient checking within the argument parser of the 'partial' and 'fetch' commands, an argument like 'body[p' was detected as 'body.peek'. This could cause a buffer overflow which could be exploited to execute arbitrary attacker-supplied code.

This update also fixes an exploitable buffer overflow that could be triggered in situations when memory allocation fails (i. e. when no free memory is available any more).

Both vulnerabilities can lead to privilege escalation to root.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
15830	Debian DSA-597-1 : cyrus-imapd - buffer overflow	Nessus	Debian Local Security Checks	2004/11/25	2021/1/4	critical
17587	Mac OS X Multiple Vulnerabilities (Security Update 2005-003)	Nessus	MacOS X Local Security Checks	2005/3/21	2024/5/28	high
15819	Cyrus IMAP Server < 2.2.10 Multiple Remote Overflows	Nessus	Gain a shell remotely	2004/11/23	2022/4/11	high
15819	Cyrus IMAP Server < 2.2.10複数のリモートオーバーフロー	Nessus	Gain a shell remotely	2004/11/23	2022/4/11	high
15833	GLSA-200411-34 : Cyrus IMAP Server: Multiple remote vulnerabilities	Nessus	Gentoo Local Security Checks	2004/11/25	2021/1/6	critical
15836	Mandrake Linux Security Advisory : cyrus-imapd (MDKSA-2004:139)	Nessus	Mandriva Local Security Checks	2004/11/26	2021/1/6	critical
15819	Cyrus IMAP Server < 2.2.10 多個遠端溢位弱點	Nessus	Gain a shell remotely	2004/11/23	2022/4/11	high
15819	Cyrus IMAP Server < 2.2.10 多个远程溢出	Nessus	Gain a shell remotely	2004/11/23	2022/4/11	high
18845	FreeBSD : Cyrus IMAPd -- PARTIAL command out of bounds memory corruption (114d70f3-3d16-11d9-8818-008088034841)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	critical
15923	SUSE-SA:2004:043: cyrus-imapd	Nessus	SuSE Local Security Checks	2004/12/7	2021/1/14	critical
20647	Ubuntu 4.10 : cyrus21-imapd vulnerabilities (USN-31-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	critical

偵測

搜尋 Plugin

critical

high

high

high

critical

critical

high

high

critical

critical

critical