The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1771 advisory.

  - cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name     (CVE-2019-11356)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4566-1 advisory.

    It was dicovered that Cyrus IMAP Server could execute arbitrary code via a crafted HTTP PUT operation for     an event with a long iCalendar property name. An attacker could use this vulnerability to cause a crash or     possibly execute arbitrary code. (CVE-2019-11356)

    It was discovered that the Cyrus IMAP Server allow users to create any mailbox with administrative     privileges. A local attacker could use this to obtain sensitive information. (CVE-2019-19783)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1771 advisory.

    [3.0.7-15.1]
    - Resolves: #1718194 - don't overrun buffer when parsing strings with sscanf()

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1771 advisory.

    The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support.

    Security Fix(es):

    * cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name     (CVE-2019-11356)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to version 3.0.10, which fixes a security issue (a buffer overrun vulnerability in the httpd daemon, CVE-2019-11356).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in the CalDAV feature in httpd of the Cyrus IMAP server, leading to denial of service or potentially the execution of arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Cyrus IMAP 3.0.10 Release Notes states :

Fixed CVE-2019-11356: buffer overrun in httpd

ID	Name	Product	Family	Severity
145588	CentOS 8 : cyrus-imapd (CESA-2019:1771)	Nessus	CentOS Local Security Checks	critical
141178	Ubuntu 18.04 LTS : Cyrus IMAP Server vulnerabilities (USN-4566-1)	Nessus	Ubuntu Local Security Checks	critical
127599	Oracle Linux 8 : cyrus-imapd (ELSA-2019-1771)	Nessus	Oracle Linux Local Security Checks	critical
126709	RHEL 8 : cyrus-imapd (RHSA-2019:1771)	Nessus	Red Hat Local Security Checks	critical
125789	Fedora 29 : cyrus-imapd (2019-f0435555ac)	Nessus	Fedora Local Security Checks	critical
125784	Debian DSA-4458-1 : cyrus-imapd - security update	Nessus	Debian Local Security Checks	critical
125744	Fedora 30 : cyrus-imapd (2019-309f559057)	Nessus	Fedora Local Security Checks	critical
125437	FreeBSD : cyrus-imapd -- buffer overrun in httpd (10fd731c-8088-11e9-b6ae-001871ec5271)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-11356

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical