CVE-2004-1011

CVE-2004-1011 describes a stack-based overflow in Cyrus IMAP Server 2.2.4–2.2.8 when the imapmagicplus option is enabled. The overflow occurs in handling long PROXY or LOGIN commands, due to copying the username into a small stack buffer without proper length checks, allowing a remote attacker to...

CVE-2004-1012

The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command "bodyp" that is treated as a different command "body.peek" and causes an index increment error that leads to an out-of-bounds memory...

CVE-2004-1011

Stack-based buffer overflow in Cyrus IMAP Server 2.2.4 through 2.2.8, with the imapmagicplus option enabled, allows remote attackers to execute arbitrary code via a long 1 PROXY or 2 LOGIN command, a different vulnerability than CVE-2004-1015...

Mandrake Linux Security Advisory : cyrus-imapd (MDKSA-2004:139)

A number of vulnerabilities in the Cyrus-IMAP server were found by Stefan Esser. Due to insufficient checking within the argument parser of the 'partial' and 'fetch' commands, a buffer overflow could be exploited to execute arbitrary attacker-supplied code. Another exploitable buffer overflow cou...

[SECURITY] [DSA 597-1] New cyrus-imapd packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 597-1 [email protected] http://www.debian.org/security/ Martin Schulze November 25th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 597-1] New cyrus-imapd packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 597-1 [email protected] http://www.debian.org/security/ Martin Schulze November 25th, 2004 http://www.debian.org/security/faq -...

Cyrus IMAP Server: Multiple remote vulnerabilities

Background The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail server. Description Multiple vulnerabilities have been discovered in the argument parsers of the 'partial' and 'fetch' commands of the Cyrus IMAP Server CAN-2004-1012, CAN-2004-1013. There are also buffer overflows in t...

DSA-597-1 cyrus-imapd - buffer overflow

Bulletin has no description...

GLSA-200411-34 : Cyrus IMAP Server: Multiple remote vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200411-34 Cyrus IMAP Server: Multiple remote vulnerabilities Multiple vulnerabilities have been discovered in the argument parsers of the 'partial' and 'fetch' commands of the Cyrus IMAP Server CAN-2004-1012, CAN-2004-1013. There...

Debian DSA-597-1 : cyrus-imapd - buffer overflow

Stefan Esser discovered several security related problems in the Cyrus IMAP daemon. Due to a bug in the command parser it is possible to access memory beyond the allocated buffer in two places which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

USN-31-1: cyrus21-imapd vulnerabilities

Stefan Esser discovered several buffer overflows in the Cyrus IMAP server. Due to insufficient checking within the argument parser of the "partial" and "fetch" commands, an argument like "bodyp" was detected as "body.peek". This could cause a buffer overflow which could be exploited to execute...

Security fix for the ALT Linux 8 package cyrus-imapd version 2.2.10-alt1

Nov. 24, 2004 Alexei Takaseev 2.2.10-alt1 - 2.2.10 - CAN-2004-1015...

Advisory 15/2004: Cyrus IMAP Server multiple remote vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: Cyrus IMAP Server multiple remote vulnerabilities Release Date: 2004/11/22 Last Modified: 2004/11/22 Author: Stefan Esser [email protected] Application: Cyrus IMAP Server = 2.2.8...

Cyrus IMAPD < 2.2.10 Multiple Vulnerabilities

Binary data 2425.prm...

Cyrus IMAP Server < 2.2.10 Multiple Remote Overflows

According to its banner, the remote Cyrus IMAPD server is vulnerable to one pre-authentication buffer overflow, as well as three post- authentication buffer overflows. A remote attacker could exploit these issues to crash the server, or possibly execute arbitrary code. %NASLMINLEVEL 70300 C Tenab...

Security fix for the ALT Linux 8 package cyrus-imapd version 2.2.9-alt1

Nov. 23, 2004 Alexei Takaseev 2.2.9-alt1 - 2.2.9 - This release implements several bugfixes, notably one where lmtpproxyd could reuse a freed connection, another involving a pre-authentication buffer overrun in "imap magic plus" support CAN-2004-1011 and lack of bounds checking in PARTIAL and...

Debian DSA-563-3 : cyrus-sasl - unsanitised input

This advisory is an addition to DSA 563-1 and 563-2 which weren't able to supersede the library on sparc and arm due to a different version number for them in the stable archive. Other architectures were updated properly. Another problem was reported in connection with sendmail, though, which...

Debian DSA-568-1 : cyrus-sasl-mit - unsanitised input

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. The library honors the environment variable SASLPATH blindly, which allows a local user to...

Cyrus IMAPd -- APPEND command uses undefined programming construct

To support MULTIAPPENDS the cmdappend handler uses the global stage array. This array is one of the things that gets destructed when the fatal function is triggered. When the Cyrus IMAP code adds new entries to this array this is done with the help of the postfix increment operator in combination...

Cyrus IMAPd -- PARTIAL command out of bounds memory corruption

Due to a bug within the argument parser of the partial command an argument like "bodyp" will be wrongly detected as "body.peek". Because of this the bufferposition gets increased by 10 instead of 5 and could therefore point outside the allocated memory buffer for the rest of the parsing process. ...