Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-123f2b3666 advisory.

    - Security fix for CVE-2024-34055

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f3e0255c75 advisory.

    - Security fix for CVE-2024-34055

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5708 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5708-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 11, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cyrus-imapd     CVE ID         : CVE-2024-34055

    Damian Poddebniak discovered that the Cyrus IMAP server didn't restrict     memory allocation for some command arguments which may result in denial     of service. This update backports new config directives which allow to     configure limits, additional details can be found at:

    https://www.cyrusimap.org/3.6/imap/download/release-notes/3.6/x/3.6.5.html

    These changes are too intrusive to be backported to the version of     Cyrus in the oldstable distribution (bullseye). If the IMAP server is used     by untrusted users an update to Debian stable/bookworm is recommended.
    In addition the version of cyrus-imapd in bullseye-backports will be     updated with a patch soon.

    For the stable distribution (bookworm), this problem has been fixed in     version 3.6.1-4+deb12u2.

    We recommend that you upgrade your cyrus-imapd packages.

    For the detailed security status of cyrus-imapd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cyrus-imapd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 14908bda-232b-11ef-b621-00155d645102 advisory.

    Cyrus IMAP 3.8.3 Release Notes states:
    Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to cause     unbounded memory allocation by sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of negotiated length, and for these the     server allocates memory to receive the content before instructing the client to proceed. The allocated     memory is released when the whole command has been received and processed.
    The IMAP protocol has a number commands that specify an unlimited number of arguments, for example SEARCH.
    Each of these arguments can be a LITERAL, for which memory will be allocated and not released until the     entire command has been received and processed. This can run a server out of memory, with varying     consequences depending on the server's OOM policy.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200505	Fedora 39 : cyrus-imapd (2024-123f2b3666)	Nessus	Fedora Local Security Checks	medium
200503	Fedora 40 : cyrus-imapd (2024-f3e0255c75)	Nessus	Fedora Local Security Checks	medium
200366	Debian dsa-5708 : cyrus-admin - security update	Nessus	Debian Local Security Checks	medium
200144	FreeBSD : cyrus-imapd -- unbounded memory allocation (14908bda-232b-11ef-b621-00155d645102)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2024-34055

medium

Tenable Plugins

medium

medium

medium

medium