Debian Security Advisory DSA 1893-1 (cyrus-imapd-2.2 kolab-cyrus-imapd)

Published: 2009-09-28 17:09:13
CVE Author: NIST National Vulnerability Database (NVD)

CVSS Base Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Recommendations:
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201893-1

Technical Details:
It was discovered that the SIEVE component of cyrus-imapd and kolab-cyrus-imapd, the Cyrus mail system, is vulnerable to a buffer overflow when processing SIEVE scripts. This can be used to elevate privileges to the cyrus system user. An attacker who is able to install SIEVE scripts executed by the server is therefore able to read and modify arbitrary email messages on the system. The update introduced by DSA 1881-1 was incomplete and the issue has been given an additional CVE id due to its complexity. For the oldstable distribution (etch), this problem has been fixed in version 2.2.13-10+etch4 for cyrus-imapd-2.2 and version 2.2.13-2+etch2 for kolab-cyrus-imapd. For the stable distribution (lenny), this problem has been fixed in version 2.2.13-14+lenny3 for cyrus-imapd-2.2, version 2.2.13-5+lenny2 for kolab-cyrus-imapd. For the testing distribution (squeeze), this problem will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 2.2.13-15 for cyrus-imapd-2.2, and will be fixed soon for kolab-cyrus-imapd. We recommend that you upgrade your cyrus-imapd-2.2 and kolab-cyrus-imapd

Summary:
The remote host is missing an update to cyrus-imapd-2.2 kolab-cyrus-imapd announced via advisory DSA 1893-1.

Detection Type:
Linux Distribution Package

Solution Type:
Vendor Patch

NIST (National Institute of Standards and Technology) NVD (National Vulnerability Database)

https://nvd.nist.gov/vuln/detail/CVE-2009-2632
https://nvd.nist.gov/vuln/detail/CVE-2009-3235

Search
Severity
High
CVSS Score
7.5

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities. It is free and always will be.