Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1459 advisory.

    - fix more buffer overflows in cyrus sieve (CVE-2009-3235)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2009-2632 cyrus-imapd: buffer overflow in cyrus sieve

CVE-2009-3235 cyrus-impad: CMU sieve buffer overflows

Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve implementation. An authenticated user able to create Sieve mail filtering rules could use these flaws to execute arbitrary code with the privileges of the Cyrus IMAP server user. (CVE-2009-2632, CVE-2009-3235)

After installing the update, cyrus-imapd will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201110-04 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause the       remote execution of arbitrary code, or a Denial of Service condition, to       conduct directory traversal attacks, corrupt data, or disclose       information.
  Workaround :

    There is no known workaround at this time.

This update fixes another buffer overflow in the Sieve code (CVE-2009-3235). This can be exploited by users allowed to use their own sieve scripts to execute arbitrary code remotely. Additionally the handling of long headers was improved.

A vulnerability was discovered and corrected in dovecot :

Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632 (CVE-2009-3235).

Packages for 2009.1 were missing with the previous MDVSA-2009:242 update. This update corrects this.

This update provides a solution to this vulnerability.

It was discovered that the SIEVE component of cyrus-imapd and kolab-cyrus-imapd, the Cyrus mail system, is vulnerable to a buffer overflow when processing SIEVE scripts. This can be used to elevate privileges to the cyrus system user. An attacker who is able to install SIEVE scripts executed by the server is therefore able to read and modify arbitrary email messages on the system. The update introduced by DSA 1881-1 was incomplete and the issue has been given an additional CVE id due to its complexity.

It was discovered that the SIEVE component of dovecot, a mail server that supports mbox and maildir mailboxes, is vulnerable to a buffer overflow when processing SIEVE scripts. This can be used to elevate privileges to the dovecot system user. An attacker who is able to install SIEVE scripts executed by the server is therefore able to read and modify arbitrary email messages on the system.

Updated cyrus-imapd packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support.

Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve implementation. An authenticated user able to create Sieve mail filtering rules could use these flaws to execute arbitrary code with the privileges of the Cyrus IMAP server user. (CVE-2009-2632, CVE-2009-3235)

Users of cyrus-imapd are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the update, cyrus-imapd will be restarted automatically.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.2.

Mac OS X 10.6.2 contains security fixes for the following products :

  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - Certificate Assistant
  - CoreMedia
  - CUPS
  - Dovecot
  - fetchmail
  - file
  - FTP Server
  - Help Viewer
  - ImageIO
  - IOKit
  - IPSec
  - Kernel
  - Launch Services
  - libsecurity
  - libxml
  - Login Window
  - OpenLDAP
  - QuickDraw Manager
  - QuickTime
  - Screen Sharing
  - Subversion

This update of dovecot fixes two buffer overflows in the sieve plug-in (CVE-2009-2632, CVE-2009-3235)

It was discovered that the ACL plugin in Dovecot would incorrectly handle negative access rights. An attacker could exploit this flaw to access the Dovecot server, bypassing the intended access restrictions.
This only affected Ubuntu 8.04 LTS. (CVE-2008-4577)

It was discovered that the ManageSieve service in Dovecot incorrectly handled '..' in script names. A remote attacker could exploit this to read and modify arbitrary sieve files on the server. This only affected Ubuntu 8.10. (CVE-2008-5301)

It was discovered that the Sieve plugin in Dovecot incorrectly handled certain sieve scripts. An authenticated user could exploit this with a crafted sieve script to cause a denial of service or possibly execute arbitrary code. (CVE-2009-2632, CVE-2009-3235).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixed multiple stack-based buffer overflows in libsieve, which allowed context- dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered and corrected in dovecot :

Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632 (CVE-2009-3235).

This update provides a solution to this vulnerability.

dovecot-sieve updated to 1.1.7 It is derived from CMU sieve used by cyrus- imapd and was affected by CVE-2009-2632 too. See upstream announcement for further details: http://dovecot.org/list/dovecot- news/2009-September/000135.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67930	Oracle Linux 5 : cyrus-imapd (ELSA-2009-1459)	Nessus	Oracle Linux Local Security Checks	critical
60669	Scientific Linux Security Update : cyrus-imapd on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
56446	GLSA-201110-04 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
49843	SuSE 10 Security Update : Cyrus IMAPD (ZYPP Patch Number 6521)	Nessus	SuSE Local Security Checks	high
49743	Mandriva Linux Security Advisory : dovecot (MDVSA-2010:196)	Nessus	Mandriva Local Security Checks	high
44758	Debian DSA-1893-1 : cyrus-imapd-2.2 kolab-cyrus-imapd - buffer overflow	Nessus	Debian Local Security Checks	high
44757	Debian DSA-1892-1 : dovecot - buffer overflow	Nessus	Debian Local Security Checks	high
43795	CentOS 4 / 5 : cyrus-imapd (CESA-2009:1459)	Nessus	CentOS Local Security Checks	high
42434	Mac OS X 10.6.x < 10.6.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
42322	openSUSE 10 Security Update : cyrus-imapd (cyrus-imapd-6511)	Nessus	SuSE Local Security Checks	high
42316	openSUSE Security Update : cyrus-imapd (cyrus-imapd-1337)	Nessus	SuSE Local Security Checks	high
42314	openSUSE Security Update : cyrus-imapd (cyrus-imapd-1337)	Nessus	SuSE Local Security Checks	high
42302	SuSE 10 Security Update : Cyrus IMAPD (ZYPP Patch Number 6509)	Nessus	SuSE Local Security Checks	high
42300	SuSE 11 Security Update : Cyrus IMAPD (SAT Patch Number 1335)	Nessus	SuSE Local Security Checks	high
42299	SuSE9 Security Update : Cyrus IMAPD (YOU Patch Number 12520)	Nessus	SuSE Local Security Checks	high
42104	openSUSE 10 Security Update : dovecot (dovecot-6539)	Nessus	SuSE Local Security Checks	high
42103	openSUSE Security Update : dovecot (dovecot-1366)	Nessus	SuSE Local Security Checks	high
42102	openSUSE Security Update : dovecot (dovecot-1366)	Nessus	SuSE Local Security Checks	high
41940	Ubuntu 8.04 LTS / 8.10 / 9.04 : dovecot vulnerabilities (USN-838-1)	Nessus	Ubuntu Local Security Checks	high
41614	Fedora 11 : cyrus-imapd-2.3.15-1.fc11 (2009-9901)	Nessus	Fedora Local Security Checks	high
41613	Fedora 10 : cyrus-imapd-2.3.15-1.fc10 (2009-9869)	Nessus	Fedora Local Security Checks	high
41065	RHEL 4 / 5 : cyrus-imapd (RHSA-2009:1459)	Nessus	Red Hat Local Security Checks	high
41050	Mandriva Linux Security Advisory : dovecot (MDVSA-2009:242)	Nessus	Mandriva Local Security Checks	high
40992	Fedora 10 : dovecot-1.1.18-2.fc10 (2009-9559)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-3235

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high