Detections
Analytics
Amazon Linux AMI : cyrus-imapd (ALAS-2011-27)
high Nessus Plugin ID 69586
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
An authentication bypass flaw was found in the cyrus-imapd NNTP server, nntpd. A remote user able to use the nntpd service could use this flaw to read or post newsgroup messages on an NNTP server configured to require user authentication, without providing valid authentication credentials. (CVE-2011-3372)A NULL pointer dereference flaw was found in the cyrus-imapd IMAP server, imapd. A remote attacker could send a specially crafted mail message to a victim that would possibly prevent them from accessing their mail normally, if they were using an IMAP client that relies on the server threading IMAP feature. (CVE-2011-3481)
Solution
Run 'yum update cyrus-imapd' to update your system.See Also
Plugin Details
Severity: High
ID: 69586
File Name: ala_ALAS-2011-27.nasl
Version: 1.6
Type: local
Agent: unix
Published: 9/4/2013
Updated: 4/18/2018
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:amazon:linux:cyrus-imapd-devel, p-cpe:/a:amazon:linux:cyrus-imapd, p-cpe:/a:amazon:linux:cyrus-imapd-utils, p-cpe:/a:amazon:linux:cyrus-imapd-debuginfo, cpe:/o:amazon:linux
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Patch Publication Date: 12/9/2011
Reference Information
CVE: CVE-2011-3372, CVE-2011-3481