Articles / Debian: Security update for…

Debian: Security update for cyrus-imapd

Multiple security issues have been discovered in cyrus-imapd, a highly scalable mail system designed for use in enterprise environments. Coverity discovered a stack-based buffer overflow in the NNTP server implementation (nttpd) of cyrus-imapd. An attacker can exploit this flaw via several crafted NNTP commands to execute arbitrary code. Stefan Cornelius of Secunia Research discovered that the command processing of the NNTP server implementation (nttpd) of cyrus-imapd is not properly implementing access restrictions for certain commands and is not checking for a complete, successful authentication. Updated packages are available from security.debian.org.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA-2318-1                    security@debian.org
http://www.debian.org/security/                                 Nico Golde
Oct 6, 2011                             http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : cyrus-imapd-2.2
Vulnerability  : multiple
Problem type   : remote
Debian-specific: no
Debian bug     : none
CVE IDs        : CVE-2011-3372 CVE-2011-3208

Multiple security issues have been discovered in cyrus-imapd, a highly scalable
mail system designed for use in enterprise environments.  The Common
Vulnerabilities and Exposures project identifies the following problems:

CVE-2011-3208

   Coverity discovered a stack-based buffer overflow in the NNTP server
   implementation (nttpd) of cyrus-imapd.  An attacker can exploit this
   flaw via several crafted NNTP commands to execute arbitrary code.

CVE-2011-3372

   Stefan Cornelius of Secunia Research discovered that the command processing
   of the NNTP server implementation (nttpd) of cyrus-imapd is not properly
   implementing access restrictions for certain commands and is not checking
   for a complete, successful authentication.  An attacker can use this flaw
   to bypass access restrictions for some commands and, e.g. exploit
   CVE-2011-3208 without proper authentication.


For the oldstable distribution (lenny), this problem has been fixed in
version 2.2_2.2.13-14+lenny5.

For the stable distribution (squeeze), this problem has been fixed in
version 2.2_2.2.13-19+squeeze2.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
cyrus-imapd-2.4 version 2.4.12-1.

We recommend that you upgrade your cyrus-imapd-2.2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk6OPm0ACgkQHYflSXNkfP9HGwCfd/kxC5Bh+5Znd209pzR91YsQ
4X4AoI1A4LlNso19D5a6VKZ3jVUf4rZ5
=HqzP
-----END PGP SIGNATURE-----
Screenshot

Project Spotlight

Kigo Video Converter Ultimate for Mac

A tool for converting and editing videos.

Screenshot

Project Spotlight

Kid3

An efficient tagger for MP3, Ogg/Vorbis, and FLAC files.