Package name
cyrus-imapd
Date
2011-10-14
Advisory ID
MDVSA-2011:149
Affected versions
2009.0 x86_64 , MES5 i586 , 2010.1 i586 , 2011 x86_64 , 2009.0 i586 , 2011 i586 , MES5 x86_64 , 2010.1 x86_64

Problem description

Multiple vulnerabilities has been discovered and corrected in
cyrus-imapd:

Stack-based buffer overflow in the split_wildmats function in nntpd.c
in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11
allows remote attackers to execute arbitrary code via a crafted NNTP
command (CVE-2011-3208).

Secunia Research has discovered a vulnerability in Cyrus IMAPd,
which can be exploited by malicious people to bypass certain security
restrictions. The vulnerability is caused due to an error within the
authentication mechanism of the NNTP server, which can be exploited
to bypass the authentication process and execute commands intended
for authenticated users by sending an AUTHINFO USER command without
a following AUTHINFO PASS command (CVE-2011-3372).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct these issues.

Updated packages

2009.0 x86_64

 ddd19215cbb8d0f739ab3eac2ed9195b  2009.0/x86_64/cyrus-imapd-2.3.12-0.p2.4.3mdv2009.0.x86_64.rpm
 835254b0b18a7a31deabf3dafb25c505  2009.0/x86_64/cyrus-imapd-devel-2.3.12-0.p2.4.3mdv2009.0.x86_64.rpm
 a4140740defa18ad54124b59ac5ced08  2009.0/x86_64/cyrus-imapd-murder-2.3.12-0.p2.4.3mdv2009.0.x86_64.rpm
 f175718d4f8c935eaea646aacfb87fd2  2009.0/x86_64/cyrus-imapd-nntp-2.3.12-0.p2.4.3mdv2009.0.x86_64.rpm
 8abf84c4ae32460ce1b9fa540c0e8e1f  2009.0/x86_64/cyrus-imapd-utils-2.3.12-0.p2.4.3mdv2009.0.x86_64.rpm
 d42f6a2dda95ff5f7e78a7d2ddc63634  2009.0/x86_64/perl-Cyrus-2.3.12-0.p2.4.3mdv2009.0.x86_64.rpm 
 a41a72745a688b0949ae18f726a4a899  2009.0/SRPMS/cyrus-imapd-2.3.12-0.p2.4.3mdv2009.0.src.rpm

MES5 i586

 c7fd893f177ccdb0e1bc965ef2a03dc6  mes5/i586/cyrus-imapd-2.3.12-0.p2.4.3mdvmes5.2.i586.rpm
 e503472475bc013c4c7cc243bcac541b  mes5/i586/cyrus-imapd-devel-2.3.12-0.p2.4.3mdvmes5.2.i586.rpm
 33fcfe50614189975eb5ee5d3a65f908  mes5/i586/cyrus-imapd-murder-2.3.12-0.p2.4.3mdvmes5.2.i586.rpm
 100ece0aadd61e09963e6d72ac9b5fb2  mes5/i586/cyrus-imapd-nntp-2.3.12-0.p2.4.3mdvmes5.2.i586.rpm
 032bd3b1c4e554676db6ecbc9063a9c9  mes5/i586/cyrus-imapd-utils-2.3.12-0.p2.4.3mdvmes5.2.i586.rpm
 9387c22cbe5a1fa40dae1cb9a502b286  mes5/i586/perl-Cyrus-2.3.12-0.p2.4.3mdvmes5.2.i586.rpm 
 57e222015b6d051ab5246d1deed73804  mes5/SRPMS/cyrus-imapd-2.3.12-0.p2.4.3mdvmes5.2.src.rpm

2010.1 i586

 b2510223c771d01a0a43c07f42cb0be6  2010.1/i586/cyrus-imapd-2.3.15-10.3mdv2010.2.i586.rpm
 ff5eaf5369620b878391c031833e869a  2010.1/i586/cyrus-imapd-devel-2.3.15-10.3mdv2010.2.i586.rpm
 b9beb4b0160a2eda64fafb1bd2cd5dcb  2010.1/i586/cyrus-imapd-murder-2.3.15-10.3mdv2010.2.i586.rpm
 646c64b84804113026d7fbee610623de  2010.1/i586/cyrus-imapd-nntp-2.3.15-10.3mdv2010.2.i586.rpm
 7e0d6868b3383fd9982e93c8f5daf34d  2010.1/i586/cyrus-imapd-utils-2.3.15-10.3mdv2010.2.i586.rpm
 b0d952ba0fa0bd49a3f7d66dfd0d20ab  2010.1/i586/perl-Cyrus-2.3.15-10.3mdv2010.2.i586.rpm 
 91f58a4c94abbe71004c81d22d1dd954  2010.1/SRPMS/cyrus-imapd-2.3.15-10.3mdv2010.2.src.rpm

2011 x86_64

 ce0c97c28bc8a6b6f388530d92e5b33e  2011/x86_64/cyrus-imapd-2.3.16-7.1-mdv2011.0.x86_64.rpm
 61457b6448ec7faf3943ac4b87bb0482  2011/x86_64/cyrus-imapd-devel-2.3.16-7.1-mdv2011.0.x86_64.rpm
 e86a7e251cb50d53c86c4ae2b016ecf1  2011/x86_64/cyrus-imapd-murder-2.3.16-7.1-mdv2011.0.x86_64.rpm
 1a95f9257bb366be1da897af9ed4a495  2011/x86_64/cyrus-imapd-nntp-2.3.16-7.1-mdv2011.0.x86_64.rpm
 2f72036afd5b32e8fcce130340334cd9  2011/x86_64/cyrus-imapd-utils-2.3.16-7.1-mdv2011.0.x86_64.rpm
 2dddd70d1c8df83d30abea15895a02fa  2011/x86_64/perl-Cyrus-2.3.16-7.1-mdv2011.0.x86_64.rpm 
 6438fb0d0c9545c3c773598875e6e0f6  2011/SRPMS/cyrus-imapd-2.3.16-7.1.src.rpm

2009.0 i586

 54e4d920a1dc6961449fe92a21d70aea  2009.0/i586/cyrus-imapd-2.3.12-0.p2.4.3mdv2009.0.i586.rpm
 b027ab6d3826bb90f3efeeaf9f0cfd38  2009.0/i586/cyrus-imapd-devel-2.3.12-0.p2.4.3mdv2009.0.i586.rpm
 e12bf8783bfdabd829527b7a9a98ab91  2009.0/i586/cyrus-imapd-murder-2.3.12-0.p2.4.3mdv2009.0.i586.rpm
 83a6a642fbeedc4d5f0adc5719a0080c  2009.0/i586/cyrus-imapd-nntp-2.3.12-0.p2.4.3mdv2009.0.i586.rpm
 2f893ebd6b25ed7f91af9d139e3cdf67  2009.0/i586/cyrus-imapd-utils-2.3.12-0.p2.4.3mdv2009.0.i586.rpm
 aa73b1fc08697d507a1b498dac9fc9d3  2009.0/i586/perl-Cyrus-2.3.12-0.p2.4.3mdv2009.0.i586.rpm 
 a41a72745a688b0949ae18f726a4a899  2009.0/SRPMS/cyrus-imapd-2.3.12-0.p2.4.3mdv2009.0.src.rpm

2011 i586

 ebe69cb95fb6874413e4fa97648d6cad  2011/i586/cyrus-imapd-2.3.16-7.1-mdv2011.0.i586.rpm
 cd7fbd790cb66ecd639bf8b128668cac  2011/i586/cyrus-imapd-devel-2.3.16-7.1-mdv2011.0.i586.rpm
 eb78400f64696546133b277556047d2b  2011/i586/cyrus-imapd-murder-2.3.16-7.1-mdv2011.0.i586.rpm
 e88682e14a537ac865af12bb6d804724  2011/i586/cyrus-imapd-nntp-2.3.16-7.1-mdv2011.0.i586.rpm
 e4677ac6a793215bb72ad163dcae1774  2011/i586/cyrus-imapd-utils-2.3.16-7.1-mdv2011.0.i586.rpm
 8276f4a486bbbadbb5423c26b4adf0d6  2011/i586/perl-Cyrus-2.3.16-7.1-mdv2011.0.i586.rpm 
 6438fb0d0c9545c3c773598875e6e0f6  2011/SRPMS/cyrus-imapd-2.3.16-7.1.src.rpm

MES5 x86_64

 1d809a8f695f1b8fbc407af0dc216ca0  mes5/x86_64/cyrus-imapd-2.3.12-0.p2.4.3mdvmes5.2.x86_64.rpm
 b9bf166cfe741ae746674d05c3d6ad3a  mes5/x86_64/cyrus-imapd-devel-2.3.12-0.p2.4.3mdvmes5.2.x86_64.rpm
 3739c923a3b3d0fccc598d468eaa2048  mes5/x86_64/cyrus-imapd-murder-2.3.12-0.p2.4.3mdvmes5.2.x86_64.rpm
 5971440e8872b5a820c2fc6e9c151b06  mes5/x86_64/cyrus-imapd-nntp-2.3.12-0.p2.4.3mdvmes5.2.x86_64.rpm
 d0d378499795a0a5aefabf6ea321f064  mes5/x86_64/cyrus-imapd-utils-2.3.12-0.p2.4.3mdvmes5.2.x86_64.rpm
 2dc5d80a0c361b2a9216c5368cf2bed9  mes5/x86_64/perl-Cyrus-2.3.12-0.p2.4.3mdvmes5.2.x86_64.rpm 
 57e222015b6d051ab5246d1deed73804  mes5/SRPMS/cyrus-imapd-2.3.12-0.p2.4.3mdvmes5.2.src.rpm

2010.1 x86_64

 d0c07cb3c99c41c97e185074b3e5f68b  2010.1/x86_64/cyrus-imapd-2.3.15-10.3mdv2010.2.x86_64.rpm
 30a9fc8ee330a3d148cf30fa0c068695  2010.1/x86_64/cyrus-imapd-devel-2.3.15-10.3mdv2010.2.x86_64.rpm
 9e9b90b86fc365b7714c07d19f6211f1  2010.1/x86_64/cyrus-imapd-murder-2.3.15-10.3mdv2010.2.x86_64.rpm
 a3f454c4bc8b9d49fc285a2f258c5641  2010.1/x86_64/cyrus-imapd-nntp-2.3.15-10.3mdv2010.2.x86_64.rpm
 c27bc4046e4edb82d5ef0afb30b1fb19  2010.1/x86_64/cyrus-imapd-utils-2.3.15-10.3mdv2010.2.x86_64.rpm
 be0dbebb632f2e054465cdeda28edbf7  2010.1/x86_64/perl-Cyrus-2.3.15-10.3mdv2010.2.x86_64.rpm 
 91f58a4c94abbe71004c81d22d1dd954  2010.1/SRPMS/cyrus-imapd-2.3.15-10.3mdv2010.2.src.rpm

References