A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.

The remote host is affected by the vulnerability described in GLSA-202208-15 (isync: Multiple Vulnerabilities)

  - A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP     LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names     containing '..' path components to access data outside the designated mailbox on the opposite end of the     synchronization channel. The highest threat from this vulnerability is to data confidentiality and     integrity. (CVE-2021-20247)

  - A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or     compromised server to write an arbitrary integer value past the end of a heap-allocated structure by     issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on     the client. (CVE-2021-3578)

  - A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB)     IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders,     could cause several different buffer overflows, which could conceivably be exploited for remote code     execution. (CVE-2021-3657)

  - A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or     compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an     empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.
    (CVE-2021-44143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3066 advisory.

  - A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP     LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names     containing '..' path components to access data outside the designated mailbox on the opposite end of the     synchronization channel. The highest threat from this vulnerability is to data confidentiality and     integrity. (CVE-2021-20247)

  - A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or     compromised server to write an arbitrary integer value past the end of a heap-allocated structure by     issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on     the client. (CVE-2021-3578)

  - A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB)     IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders,     could cause several different buffer overflows, which could conceivably be exploited for remote code     execution. (CVE-2021-3657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1170-1 advisory.

  - A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or     compromised server to write an arbitrary integer value past the end of a heap-allocated structure by     issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on     the client. (CVE-2021-3578)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
164046	GLSA-202208-15 : isync: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
162682	Debian DLA-3066-1 : isync - LTS security update	Nessus	Debian Local Security Checks	critical
152730	openSUSE 15 Security Update : isync (openSUSE-SU-2021:1170-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-3578

high

Tenable Plugins

critical

critical

high