PT-2004-2015 · Cyrus · Cyrus Imap Server

Stefan Esser · Publicado 2004-12-01 · Atualizado 2016-12-08 · CVE-2004-1013

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cyrus IMAP Server versions 2.2.x through 2.2.8

Description: The issue concerns the argument parser of the FETCH command in Cyrus IMAP Server, which allows remote authenticated users to execute arbitrary code. This can be achieved through specific commands, such as "body[p", "binary[p", or "binary[p", that cause an index increment error. This error leads to an out-of-bounds memory corruption, enabling the execution of arbitrary code.

Recommendations: For Cyrus IMAP Server versions 2.2.x through 2.2.8, consider disabling the FETCH command until a patch is available to prevent the execution of arbitrary code. Restrict access to the affected command to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-1013

DSA-597-1

Produtos afetados

Cyrus Imap Server

Referências · 13

• https://ubuntu.com/usn/usn-31-1 · Aviso do Fabricante
• http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=143 · Nota
• http://marc.info/?l=bugtraq&m=110123023521619&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1013 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2004-1013 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2004-1013 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200411-34.xml · Aviso do Fabricante
• http://debian.org/security/2004/dsa-597 · Aviso do Fabricante
• http://asg.web.cmu.edu/cyrus/download/imapd/changes.html · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2004:139 · Aviso do Fabricante
• http://security.e-matters.de/advisories/152004.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-1013 · Aviso do Fabricante
• http://secunia.com/advisories/13274 · Nota