Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7224-1 advisory.

    It was discovered that non-authentication-related HTTP requests could be interpreted in an authentication     context by a Cyrus IMAP Server when multiple requests arrived over the same connection. An unauthenticated     attacker could possibly use this issue to perform a privilege escalation attack. This issue only affected     Ubuntu 18.04 LTS. (CVE-2019-18928)

    Matthew Horsfall discovered that Cyrus IMAP Server utilized a poor string hashing algorithm that could be     abused to control where data was being stored. An attacker could possibly use this issue to perform a     denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33582)

    Damian Poddebniak discovered that Cyrus IMAP Server could interpret specially crafted commands to exploit     a memory issue. An authenticated attacker could possibly use this issue to perform a denial of service.
    This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-34055)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-9195 advisory.

    [3.4.8-1]
    - Update to 3.4.8, fixing CVE-2024-34055

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-cfbdc342a2 advisory.

    Automatic update for cyrus-imapd-3.8.3-1.fc41.

    ##### **Changelog**

    ```
    * Wed Jun  5 2024 Martin Osvald <mosvald@redhat.com> - 3.8.3-1
    - Fix CVE-2024-34055 (rhbz#2290512)
    - Convert to %autorelease and %autochangelog

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9195 advisory.

    The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support.

    Security Fix(es):

    * cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command (CVE-2024-34055)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-123f2b3666 advisory.

    - Security fix for CVE-2024-34055

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f3e0255c75 advisory.

    - Security fix for CVE-2024-34055

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5708 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5708-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 11, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cyrus-imapd     CVE ID         : CVE-2024-34055

    Damian Poddebniak discovered that the Cyrus IMAP server didn't restrict     memory allocation for some command arguments which may result in denial     of service. This update backports new config directives which allow to     configure limits, additional details can be found at:

    https://www.cyrusimap.org/3.6/imap/download/release-notes/3.6/x/3.6.5.html

    These changes are too intrusive to be backported to the version of     Cyrus in the oldstable distribution (bullseye). If the IMAP server is used     by untrusted users an update to Debian stable/bookworm is recommended.
    In addition the version of cyrus-imapd in bullseye-backports will be     updated with a patch soon.

    For the stable distribution (bookworm), this problem has been fixed in     version 3.6.1-4+deb12u2.

    We recommend that you upgrade your cyrus-imapd packages.

    For the detailed security status of cyrus-imapd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cyrus-imapd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 14908bda-232b-11ef-b621-00155d645102 advisory.

    Cyrus IMAP 3.8.3 Release Notes states:
    Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to cause     unbounded memory allocation by sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of negotiated length, and for these the     server allocates memory to receive the content before instructing the client to proceed. The allocated     memory is released when the whole command has been received and processed.
    The IMAP protocol has a number commands that specify an unlimited number of arguments, for example SEARCH.
    Each of these arguments can be a LITERAL, for which memory will be allocated and not released until the     entire command has been received and processed. This can run a server out of memory, with varying     consequences depending on the server's OOM policy.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
214517	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Cyrus IMAP Server vulnerabilities (USN-7224-1)	Nessus	Ubuntu Local Security Checks	critical
211550	Oracle Linux 9 : cyrus-imapd (ELSA-2024-9195)	Nessus	Oracle Linux Local Security Checks	medium
211015	Fedora 41 : cyrus-imapd (2024-cfbdc342a2)	Nessus	Fedora Local Security Checks	medium
210807	RHEL 9 : cyrus-imapd (RHSA-2024:9195)	Nessus	Red Hat Local Security Checks	medium
200505	Fedora 39 : cyrus-imapd (2024-123f2b3666)	Nessus	Fedora Local Security Checks	medium
200503	Fedora 40 : cyrus-imapd (2024-f3e0255c75)	Nessus	Fedora Local Security Checks	medium
200366	Debian dsa-5708 : cyrus-admin - security update	Nessus	Debian Local Security Checks	medium
200144	FreeBSD : cyrus-imapd -- unbounded memory allocation (14908bda-232b-11ef-b621-00155d645102)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2024-34055

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium