A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

The remote host is affected by the vulnerability described in GLSA-202208-15 (isync: Multiple Vulnerabilities)

  - A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP     LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names     containing '..' path components to access data outside the designated mailbox on the opposite end of the     synchronization channel. The highest threat from this vulnerability is to data confidentiality and     integrity. (CVE-2021-20247)

  - A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or     compromised server to write an arbitrary integer value past the end of a heap-allocated structure by     issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on     the client. (CVE-2021-3578)

  - A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB)     IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders,     could cause several different buffer overflows, which could conceivably be exploited for remote code     execution. (CVE-2021-3657)

  - A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or     compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an     empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.
    (CVE-2021-44143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3066 advisory.

  - A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP     LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names     containing '..' path components to access data outside the designated mailbox on the opposite end of the     synchronization channel. The highest threat from this vulnerability is to data confidentiality and     integrity. (CVE-2021-20247)

  - A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or     compromised server to write an arbitrary integer value past the end of a heap-allocated structure by     issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on     the client. (CVE-2021-3578)

  - A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB)     IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders,     could cause several different buffer overflows, which could conceivably be exploited for remote code     execution. (CVE-2021-3657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for isync fixes the following issues :

  - isync was updated to version 1.3.5 

  - CVE-2021-20247: reject funny mailbox names from IMAP     LIST/LSUB (boo#1182488)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-ef8c2acfce advisory.

  - A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP     LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names     containing '..' path components to access data outside the designated mailbox on the opposite end of the     synchronization channel. The highest threat from this vulnerability is to data confidentiality and     integrity. (CVE-2021-20247)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-954ebabcf7 advisory.

  - A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP     LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names     containing '..' path components to access data outside the designated mailbox on the opposite end of the     synchronization channel. The highest threat from this vulnerability is to data confidentiality and     integrity. (CVE-2021-20247)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
164046	GLSA-202208-15 : isync: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
162682	Debian DLA-3066-1 : isync - LTS security update	Nessus	Debian Local Security Checks	critical
148385	openSUSE Security Update : isync (openSUSE-2021-516)	Nessus	SuSE Local Security Checks	high
147154	Fedora 33 : isync (2021-ef8c2acfce)	Nessus	Fedora Local Security Checks	high
147068	Fedora 32 : isync (2021-954ebabcf7)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2021-20247

high

Tenable Plugins

critical

critical

high

high

high