Detections
Analytics
Debian DSA-2318-1 : cyrus-imapd-2.2 - multiple vulnerabilities
high Nessus Plugin ID 56409
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Multiple security issues have been discovered in cyrus-imapd, a highly scalable mail system designed for use in enterprise environments. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2011-3208 Coverity discovered a stack-based buffer overflow in the NNTP server implementation (nttpd) of cyrus-imapd. An attacker can exploit this flaw via several crafted NNTP commands to execute arbitrary code.
- CVE-2011-3372 Stefan Cornelius of Secunia Research discovered that the command processing of the NNTP server implementation (nttpd) of cyrus-imapd is not properly implementing access restrictions for certain commands and is not checking for a complete, successful authentication. An attacker can use this flaw to bypass access restrictions for some commands and, e.g. exploit CVE-2011-3208 without proper authentication.
Solution
Upgrade the cyrus-imapd-2.2 packages.For the oldstable distribution (lenny), this problem has been fixed in version 2.2_2.2.13-14+lenny5.
For the stable distribution (squeeze), this problem has been fixed in version 2.2_2.2.13-19+squeeze2.
See Also
https://security-tracker.debian.org/tracker/CVE-2011-3208
https://security-tracker.debian.org/tracker/CVE-2011-3372
Plugin Details
Severity: High
ID: 56409
File Name: debian_DSA-2318.nasl
Version: 1.10
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 10/7/2011
Updated: 1/11/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:cyrus-imapd-2.2, cpe:/o:debian:debian_linux:5.0, cpe:/o:debian:debian_linux:6.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 10/6/2011
Reference Information
CVE: CVE-2011-3208, CVE-2011-3372
DSA: 2318