Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.

- Previous versions of cyrus-imapd would not allow its     users to disable old protocols like SSLv1 and SSLv2 that     are unsafe due to various known attacks like BEAST and     POODLE.
    https://bugzilla.cyrusimap.org/show_bug.cgi?id=3867     remedies this issue by adding the configuration option     'tls_versions' to the imapd.conf file. Note that users     who upgrade existing installation of this package will
    *not* have their imapd.conf file overwritten, i.e. their     IMAP server will continue to support SSLv1 and SSLv2     like before. To disable support for those protocols,     it's necessary to edit imapd.conf manually to state     'tls_versions: tls1_0 tls1_1 tls1_2'. New installations,     however, will have an imapd.conf file that contains     these settings already, i.e. newly installed IMAP     servers do *not* support SSLv1 and SSLv2 unless that     support is explicitly enabled by the user. (bsc#901748)

  - An integer overflow vulnerability in cyrus-imapd's     urlfetch range checking code was fixed. (CVE-2015-8076,     CVE-2015-8077, CVE-2015-8078, bsc#981670, bsc#954200,     bsc#954201)

  - Support for Elliptic Curve     Diffie&Atilde;&cent;&Acirc;&#128;&Acirc;&#147;Hellman     (ECDH) has been added to cyrus-imapd. (bsc#860611)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Cyrus IMAP 2.5.7 Release Note states :

CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks

The cyrus-imapd package was updated to fix two security issues.

  - CVE-2015-8077: Integer overflow in range checks     (bnc#954200)

  - CVE-2015-8078: Integer overflow in index_urlfetch     (bnc#954201)

ID	Name	Product	Family	Severity
91650	SUSE SLES12 Security Update : cyrus-imapd (SUSE-SU-2016:1457-1) (POODLE)	Nessus	SuSE Local Security Checks	low
87165	FreeBSD : cyrus-imapd -- integer overflow in the start_octet addition (d62ec98e-97d8-11e5-8c0e-080027b00c2e)	Nessus	FreeBSD Local Security Checks	high
87089	openSUSE Security Update : cyrus-imapd (openSUSE-2015-828)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8078

critical

Tenable Plugins

low

high

high