PT-2009-5028 · Cyrus+2 · Cyrus Imap+2

Nico Golde · Published 2009-09-08 · Updated 2017-09-19 · CVE-2009-2632

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cyrus-imapd versions 2.2.13 through 2.3.14 Dovecot versions 1.0 through 1.0.3 Dovecot versions 1.1 through 1.1.6

Description A buffer overflow in the SIEVE script component, as used in cyrus-imapd and Dovecot, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script. This issue is related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.

Recommendations For cyrus-imapd versions 2.2.13 through 2.3.14, update to a version that fixes the buffer overflow issue in the SIEVE script component. For Dovecot versions 1.0 through 1.0.3, update to version 1.0.4 or later. For Dovecot versions 1.1 through 1.1.6, update to version 1.1.7 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-2632

DSA-1881-1

DSA-1892-1

DSA-1893-1

RHSA-2009:1459

RHSA-2009_1459

Affected Products

Dovecot

Red Hat

Cyrus Imap

References · 29

• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2632 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-September/msg00491.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2632 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2632 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2559 · Vendor Advisory
• http://secunia.com/advisories/36632 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-2632 · Vendor Advisory
• http://ubuntu.com/usn/USN-838-1 · Vendor Advisory
• http://secunia.com/advisories/36629 · Vendor Advisory
• http://securityfocus.com/bid/36296 · Patch
• https://lists.andrew.cmu.edu/pipermail/cyrus-cvs/2009-September/001254.html · Note
• http://dovecot.org/list/dovecot-news/2009-September/000135.html · Note
• http://debian.org/security/2009/dsa-1881 · Patch, Vendor Advisory