The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - cyrus-imapd: Out of bounds heap read in index_urlfetch (CVE-2015-8076)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - cyrus-imapd: Out of bounds heap read in index_urlfetch (CVE-2015-8076)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cyrus-imapd: Out of bounds heap read in index_urlfetch (CVE-2015-8076)

  - cyrus-imapd: lmtpd component created mailboxes with administrator privileges if the fileinto was used,     bypassing ACL checks (CVE-2019-19783)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the cyrus-imapd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cyrus-imapd package contains the core of the Cyrus     IMAP server. It is a scaleable enterprise mail system     designed for use from small to large enterprise     environments using standards-based internet mail     technologies.

  - Security Fix(es)

  - The index_urlfetch function in index.c in Cyrus IMAP     2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before     2.5.4 allows remote attackers to obtain sensitive     information or possibly have unspecified other impact     via vectors related to the urlfetch range, which     triggers an out-of-bounds heap read.(CVE-2015-8076)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Previous versions of cyrus-imapd would not allow its     users to disable old protocols like SSLv1 and SSLv2 that     are unsafe due to various known attacks like BEAST and     POODLE.
    https://bugzilla.cyrusimap.org/show_bug.cgi?id=3867     remedies this issue by adding the configuration option     'tls_versions' to the imapd.conf file. Note that users     who upgrade existing installation of this package will
    *not* have their imapd.conf file overwritten, i.e. their     IMAP server will continue to support SSLv1 and SSLv2     like before. To disable support for those protocols,     it's necessary to edit imapd.conf manually to state     'tls_versions: tls1_0 tls1_1 tls1_2'. New installations,     however, will have an imapd.conf file that contains     these settings already, i.e. newly installed IMAP     servers do *not* support SSLv1 and SSLv2 unless that     support is explicitly enabled by the user. (bsc#901748)

  - An integer overflow vulnerability in cyrus-imapd's     urlfetch range checking code was fixed. (CVE-2015-8076,     CVE-2015-8077, CVE-2015-8078, bsc#981670, bsc#954200,     bsc#954201)

  - Support for Elliptic Curve     Diffie&Atilde;&cent;&Acirc;&#128;&Acirc;&#147;Hellman     (ECDH) has been added to cyrus-imapd. (bsc#860611)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.4.18, rhbz#1267871 and rhbz#1267878

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198955	RHEL 5 : cyrus-imapd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198941	RHEL 6 : cyrus-imapd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198912	RHEL 7 : cyrus-imapd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
99803	EulerOS 2.0 SP1 : cyrus-imapd (EulerOS-SA-2016-1040)	Nessus	Huawei Local Security Checks	high
91650	SUSE SLES12 Security Update : cyrus-imapd (SUSE-SU-2016:1457-1) (POODLE)	Nessus	SuSE Local Security Checks	low
89445	Fedora 23 : cyrus-imapd-2.4.18-1.fc23 (2015-e7712d6c32)	Nessus	Fedora Local Security Checks	high
89420	Fedora 21 : cyrus-imapd-2.4.18-1.fc21 (2015-d292a98f01)	Nessus	Fedora Local Security Checks	high
89319	Fedora 22 : cyrus-imapd-2.4.18-1.fc22 (2015-8d4b507cb0)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2015-8076

critical

Tenable Plugins

critical

critical

medium

high

low

high

high

high