Sean Larsson discovered a buffer overflow in the IMAP 'annotate' extension. This possibly allowed an authenticated IMAP client to execute arbitrary code with the privileges of the Cyrus IMAP server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

バナーによると、リモートのCyrus IMAPサーバーは、imapd注釈拡張のoff-by-oneエラーと、認証されたユーザーがトリガーできるキャッシュされたヘッダー処理、ピアニュース管理者によってトリガーされるfetchnewsのバッファオーバーフロー、およびimapdの詳細不明なスタックベースのバッファオーバーフローの影響を受けます。

cyrus-imapd で、いくつかのバッファオーバーフローのバグが見つかりました。認証された悪意のあるユーザーは、imap サーバーをクラッシュさせる可能性があります。さらに、news が fetchnews コマンドを使用して受信している場合、ピア news の管理者は、imap サーバーで任意のコードを実行する可能性があります。Common Vulnerabilities and Exposures プロジェクト（cve.mitre.org）は、この問題に CVE-2005-0546 の識別名を割り当てています。

さらに、このバージョンの rpm には、FC3 の前回の更新以降に行われたその他の修正が一括して含まれています（下記の変更ログを参照）。

>>>>>>>>>>>> X86_64 のインストールについての重要事項 <<<<<<<<<<<< この rpm では、一部の実行可能ファイルを /usr/lib64/cyrus-imapd に間違って配置していた、バグ #156121 も修正しています。/usr/lib64 は 64 ビットのライブラリ用に予約されているため、正規の場所（/usr/lib/cyrus-imapd）にこれらがあることを前提としている既存のスクリプトに対して問題を引き起こしていましたし、multilib パッケージガイドラインに違反していました。この影響を受けるのは、cyrus-imapd パッケージの外部を参照する場合のみであり、rpm 自体に矛盾はありません。最も注目すべき実例は、/usr/lib64/cyrus-impad/deliver が現在 /usr/lib/cyrus-imapd/deliver であることです（配布するよりも lmtp の使用を推奨します）。この変更の影響を受けるのは、x86_64 のインストールのみです。

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

Several buffer overflow bugs were found in cyrus-imapd. It is possible that an authenticated malicious user could cause the imap server to crash. Additionally, a peer news admin could potentially execute arbitrary code on the imap server when news is received using the fetchnews command. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0546 to this issue.

In addition this version of the rpm contains a collection of other fixes since the last FC3 update (see below changelog).

>>>>>>>>>>>> IMPORTANT NOTE FOR X86_64 INSTALLATION <<<<<<<<<<<< This rpm also fixes bug #156121 that incorrectly placed some executables /usr/lib64/cyrus-imapd. /usr/lib64 is reserved for 64 bit libraries and this caused problems for existing scripts that expected to find them in a canonical location (/usr/lib/cyrus-imapd) and violated the multilib packaging guidelines. Only references external to the cyrus-imapd package are affected by this, the rpm is self consistent. The most notable example is /usr/lib64/cyrus-impad/deliver which is now /usr/lib/cyrus-imapd/deliver (use of lmtp is encouraged in preference to deliver). This change only affects x86_64 installations.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated cyrus-imapd packages that fix several buffer overflow security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The cyrus-imapd package contains the core of the Cyrus IMAP server.

Several buffer overflow bugs were found in cyrus-imapd. It is possible that an authenticated malicious user could cause the imap server to crash. Additionally, a peer news admin could potentially execute arbitrary code on the imap server when news is received using the fetchnews command. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0546 to this issue.

Users of cyrus-imapd are advised to upgrade to these updated packages, which contain cyrus-imapd version 2.2.12 to correct these issues.

According to its banner, the remote Cyrus IMAP server is affected by off-by-one errors in its imapd annotate extension and its cached header handling which can be triggered by an authenticated user, a buffer overflow in fetchnews that can be triggered by a peer news admin, and an unspecified stack-based buffer overflow in imapd.

根据其标题，远程 Cyrus IMAP 服务器受到差一错误（可由经过身份验证的用户触发的 imapd 批注扩展和缓存标头处理）、fetchnews 中可由对等机新闻管理员触发的缓冲区溢出漏洞，以及 imapd 中不明的基于堆栈的缓冲区溢出漏洞的影响。

在 cyrus-imapd 中发现多个缓冲区溢出缺陷。经过认证的恶意用户可导致 imap 服务器崩溃。此外，新闻是使用 fetchnews 命令收到的时，对等机新闻管理员可能在 imap 服务器上执行任意代码。通用漏洞和暴露计划 (cve.mitre.org) 已为此问题分配名称 CVE-2005-0546。

此外，rpm 的此版本中包含上一个 FC3 更新以来的一系列其他补丁（参见下面的变更日志）。

>>>>>>>>>>>> 针对 X86_64 安装的重要说明 <<<<<<<<<<<< 此 rpm 还修复了缺陷 #156121，即在 /usr/lib64/cyrus-imapd 中误放置了一些可执行文件。/usr/lib64 是为 64 位库保留的，所以这将导致本应位于规范化位置 (/usr/lib/cyrus-imapd) 的现有脚本出现问题，并违反 multilib 打包指南。仅 cyrus-imapd 程序包外部的引用受此影响，rpm 自我一致。最值得注意的示例是 /usr/lib64/cyrus-impad/deliver，现在是 /usr/lib/cyrus-imapd/deliver（鼓励在要交付的首选项中使用 lmtp）。此更改仅影响 x86_64 安装。

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

根據標題來判斷，遠端 Cyrus IMAP 伺服器受到其 imapd 註解延伸模組及快取標頭處理中的差一錯誤影響，經驗證的使用者可觸發這些錯誤；fetchnews 中有一個緩衝區溢位弱點，對等端的新聞管理員可觸發此錯誤；此外，imapd 中有一個不明的堆疊型緩衝區溢位弱點。

在 cyrus-imapd 中發現數個緩衝區溢位錯誤。經驗證的惡意使用者可能造成 imap 伺服器當機。此外，當使用 fetchnews 命令接收新聞時，對等新聞系統管理員可能在 imap 伺服器上執行任意程式碼。Common Vulnerabilities and Exposures 專案 (cve.mitre.org) 已將名稱 CVE-2005-0546 指派給此問題。

此外，此版本的 rpm 包含自最新 FC3 更新之後的其他修正集合 (請參閱下方的變更記錄)。

>>>>>>>>>>>> X86_64 安裝的重要注意事項 <<<<<<<<<<<< 此 rpm 也修正未正確放置某些可執行檔 /usr/lib64/cyrus-imapd 的錯誤 #156121。/usr/lib64 保留給 64 位元程式庫，而這會對預期在 canonical 位置 (/usr/lib/cyrus-imapd) 中找到的現有指令碼造成問題，而且違反 multilib 封裝準則。只有 cyrus-imapd 套件的外部參照會受此問題影響，rpm 本身一致。最顯著的例子是 /usr/lib64/cyrus-impad/deliver，其現在為 /usr/lib/cyrus-imapd/deliver (建議在傳遞的偏好設定中使用 lmtp)。此變更只會影響 x86_64 安裝。

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The Cyrus IMAP Server ChangeLog states :

- Fix possible single byte overflow in mailbox handling code.

- Fix possible single byte overflows in the imapd annotate extension.

- Fix stack-based buffer overflows in fetchnews (exploitable by peer news server), backend (exploitable by admin), and in imapd (exploitable by users though only on platforms where a filename may be larger than a mailbox name).

The 2.1.X series are reportedly only affected by the second issue.

These issues may lead to execution of arbitrary code with the permissions of the user running the Cyrus IMAP Server.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:408 advisory.

    The cyrus-imapd package contains the core of the Cyrus IMAP server.

    Several buffer overflow bugs were found in cyrus-imapd. It is possible that     an authenticated malicious user could cause the imap server to crash.
    Additionally, a peer news admin could potentially execute arbitrary code on     the imap server when news is received using the fetchnews command. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0546 to this issue.

    Users of cyrus-imapd are advised to upgrade to these updated packages, which     contain cyrus-imapd version 2.2.12 to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200502-29 (Cyrus IMAP Server: Multiple overflow vulnerabilities)

    Possible single byte overflows have been found in the imapd annotate     extension and mailbox handling code. Furthermore stack-based buffer overflows     have been found in fetchnews, the backend and imapd.
  Impact :

    An attacker, who could be an authenticated user or an admin of a     peering news server, could exploit these vulnerabilities to execute     arbitrary code with the rights of the user running the Cyrus IMAP     Server.
  Workaround :

    There is no known workaround at this time.

Several overruns have been fixed in the IMAP annote extension as well as in cached header handling which can be run by an authenticated user. As well, additional bounds checking in fetchnews was improved to avoid exploitation by a peer news admin.

According to its banner, the remote Cyrus IMAPD server is vulnerable to multiple remote buffer overflow attacks.  An attacker exploiting these flaws would need to be able to communicate with the IMAPD server (usually on TCP port 143).  A successful attack would result in the attacker executing arbitrary code on the IMAPD server.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
20712	Ubuntu 4.10 : cyrus21-imapd vulnerability (USN-87-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	high
17208	Cyrus IMAP Server < 2.2.11複数のリモートオーバーフロー	Nessus	Gain a shell remotely	2005/2/24	2022/4/11	high
62256	Fedora Core 3：cyrus-imapd-2.2.12-1.1.fc3（2005-339）	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
62256	Fedora Core 3 : cyrus-imapd-2.2.12-1.1.fc3 (2005-339)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
21935	CentOS 4 : cyrus-imapd (CESA-2005:408)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	high
17208	Cyrus IMAP Server < 2.2.11 Multiple Remote Overflows	Nessus	Gain a shell remotely	2005/2/24	2022/4/11	high
17208	Cyrus IMAP Server < 2.2.11 多个远程溢出	Nessus	Gain a shell remotely	2005/2/24	2022/4/11	high
62256	Fedora Core 3：cyrus-imapd-2.2.12-1.1.fc3 (2005-339)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
17208	Cyrus IMAP Server < 2.2.11 多個遠端溢位弱點	Nessus	Gain a shell remotely	2005/2/24	2022/4/11	high
62256	Fedora Core 3：cyrus-imapd-2.2.12-1.1.fc3 (2005-339)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
19086	FreeBSD : cyrus-imapd -- multiple buffer overflow vulnerabilities (b2d248ad-88f6-11d9-aa18-0001020eed82)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	high
18280	RHEL 4 : cyrus-imapd (RHSA-2005:408)	Nessus	Red Hat Local Security Checks	2005/5/17	2024/11/4	critical
17206	GLSA-200502-29 : Cyrus IMAP Server: Multiple overflow vulnerabilities	Nessus	Gentoo Local Security Checks	2005/2/23	2021/1/6	high
17280	Mandrake Linux Security Advisory : cyrus-imapd (MDKSA-2005:051)	Nessus	Mandriva Local Security Checks	2005/3/6	2021/1/6	high
2645	Cyrus IMAPD < 2.2.12 Multiple Remote Overflows	Nessus Network Monitor	IMAP Servers	2005/2/24	2019/3/6	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high