Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title New cyrus-imapd packages fix remote command execution
Informations
Name DSA-215 First vendor Publication 2002-12-23
Vendor Debian Last vendor Modification 2002-12-23
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Timo Sirainen discovered a buffer overflow in the Cyrus IMAP server, which could be exploited by a remote attacker prior to logging in. A malicious user could craft a request to run commands on the server under the UID and GID of the cyrus server.

For the current stable distribution (woody) this problem has been fixed in version 1.5.19-9.1.

For the old stable distribution (potato) this problem has been fixed in version 1.5.19-2.2.

For the current unstable distribution (sid) this problem has been fixed in version 1.5.19-9.10. The cyrus21-imapd packages are not vulnerable

We recommend that you upgrade your cyrus-imapd package.

wget url will fetch the file for you dpkg -i file.deb will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update will update the internal database apt-get upgrade will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 2.2 alias potato

Original Source

Url : http://www.debian.org/security/2002/dsa-215

CAPEC : Common Attack Pattern Enumeration & Classification

Id Name
CAPEC-47 Buffer Overflow via Parameter Expansion
CAPEC-100 Overflow Buffers
CAPEC-123 Buffer Attacks

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-131 Incorrect Calculation of Buffer Size (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 6
Os 34
Os 37

OpenVAS Exploits

Date Description
2008-09-04 Name : FreeBSD Ports: cyrus
File : nvt/freebsd_cyrus.nasl
2008-01-17 Name : Debian Security Advisory DSA 215-1 (cyrus-imapd)
File : nvt/deb_215_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
55701 Cyrus IMAP Server login Command Remote Overflow
10657 Cyrus SASL Library Log Writer Overflow
10656 Cyrus SASL Library LDAP saslauthd Authentication Overflow
10655 Cyrus SASL Library User Name Canonicalization Overflow

Snort® IPS/IDS

Date Description
2014-01-10 login literal buffer overflow attempt
RuleID : 1993-community - Revision : 24 - Type : PROTOCOL-IMAP
2014-01-10 login literal buffer overflow attempt
RuleID : 1993 - Revision : 24 - Type : PROTOCOL-IMAP

Nessus® Vulnerability Scanner

Date Description
2009-04-23 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_35f6fdf8a42511d89c6d0020ed76ef5a.nasl - Type : ACT_GATHER_INFO
2005-03-21 Name : The remote host is missing a Mac OS X update that fixes a security issue.
File : macosx_SecUpd2005-003.nasl - Type : ACT_GATHER_INFO
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-215.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:29:49
  • Multiple Updates