PT-2015-3148 · Cyrus+2 · Cyrus Imap+2
Martin Prpic
·
Publicado
2015-07-11
·
Atualizado
2024-06-15
·
CVE-2015-8077
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Cyrus IMAP versions 2.3.19 through 2.5.6
Description
The issue is caused by an integer overflow in the
index urlfetch function in imap/index.c, which can be exploited by remote attackers to have an unspecified impact. This is related to urlfetch range checks and the start octet variable. The vulnerability exists due to an incomplete fix for a previous issue.Recommendations
For versions 2.3.19, 2.4.18, and 2.5.6, consider disabling the
index urlfetch function as a temporary workaround until a patch is available. Restrict access to the imap/index.c module to minimize the risk of exploitation. Avoid using the start octet variable in the affected urlfetch range checks until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Cyrus Imap
Suse