remote command execution in cyrus-imapd

2004-12-0313:37:30

lists.opensuse.org

0.107 Low

EPSS

Percentile

94.5%

JSON

Stefan Esser reported various bugs within the Cyrus IMAP Server. These include buffer overflows and out-of-bounds memory access which could allow remote attackers to execute arbitrary commands as root. The bugs occur in the pre-authentication phase, therefore an update is strongly recommended.

Solution

There is no temporary workaround except shutting down the IMAP server.

OSVersionArchitecturePackageVersionFilename
openSUSE9.2i586cyrus-imapd< 2.2.8-6.3cyrus-imapd-2.2.8-6.3.i586.rpm
openSUSE9.1i586cyrus-imapd< 2.2.3-83.19cyrus-imapd-2.2.3-83.19.i586.rpm
openSUSE8.1i586cyrus-imapd< 2.1.16-56cyrus-imapd-2.1.16-56.i586.rpm
openSUSE9.0x86_64cyrus-imapd< 2.1.15-89cyrus-imapd-2.1.15-89.x86_64.rpm
openSUSE9.1x86_64cyrus-imapd< 2.2.3-83.19cyrus-imapd-2.2.3-83.19.x86_64.rpm
openSUSE8.2i586cyrus-imapd< 2.1.12-75cyrus-imapd-2.1.12-75.i586.rpm
openSUSE9.0i586cyrus-imapd< 2.1.15-89cyrus-imapd-2.1.15-89.i586.rpm
openSUSE9.2x86_64cyrus-imapd< 2.2.8-6.3cyrus-imapd-2.2.8-6.3.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
openSUSE	9.2	i586	cyrus-imapd	< 2.2.8-6.3	cyrus-imapd-2.2.8-6.3.i586.rpm
openSUSE	9.1	i586	cyrus-imapd	< 2.2.3-83.19	cyrus-imapd-2.2.3-83.19.i586.rpm
openSUSE	8.1	i586	cyrus-imapd	< 2.1.16-56	cyrus-imapd-2.1.16-56.i586.rpm
openSUSE	9.0	x86_64	cyrus-imapd	< 2.1.15-89	cyrus-imapd-2.1.15-89.x86_64.rpm
openSUSE	9.1	x86_64	cyrus-imapd	< 2.2.3-83.19	cyrus-imapd-2.2.3-83.19.x86_64.rpm
openSUSE	8.2	i586	cyrus-imapd	< 2.1.12-75	cyrus-imapd-2.1.12-75.i586.rpm
openSUSE	9.0	i586	cyrus-imapd	< 2.1.15-89	cyrus-imapd-2.1.15-89.i586.rpm
openSUSE	9.2	x86_64	cyrus-imapd	< 2.2.8-6.3	cyrus-imapd-2.2.8-6.3.x86_64.rpm

0.107 Low

EPSS

Percentile

94.5%

JSON

Related for SUSE-SA:2004:043