Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Scientific Linux: Important cyrus-imapd Update For Buffer Overflow Risks

Calendar Sep 25, 2009 • User Avatar LinuxSecurity Advisories
2 - 3 min read
Scientific Large Esm H446
Topics%20covered

Topics Covered

security advisory buffer overflow cyrus-imapd important update Scientific Linux
Important: cyrus-imapd security update 
Date:         Fri, 25 Sep 2009 11:53:46 -0500
Reply-To:     Troy Dawson 
Sender:       Security Errata for Scientific Linux
              
From:         Troy Dawson 
Subject:      Security ERRATA Important: cyrus-imapd on SL4.x, SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
          

Synopsis:	Important: cyrus-imapd security update
Issue date:	2009-09-23
CVE Names:	CVE-2009-2632 CVE-2009-3235

CVE-2009-2632 cyrus-imapd: buffer overflow in cyrus sieve
CVE-2009-3235 cyrus-impad: CMU sieve buffer overflows

Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve
implementation. An authenticated user able to create Sieve mail 
filtering rules could use these flaws to execute arbitrary code with the 
privileges of the Cyrus IMAP server user. (CVE-2009-2632, CVE-2009-3235)

After installing the update, cyrus-imapd will be restarted automatically.

SL 4.x

       SRPMS:
cyrus-imapd-2.2.12-10.el4_8.4.src.rpm
       i386:
cyrus-imapd-2.2.12-10.el4_8.4.i386.rpm
cyrus-imapd-devel-2.2.12-10.el4_8.4.i386.rpm
cyrus-imapd-murder-2.2.12-10.el4_8.4.i386.rpm
cyrus-imapd-nntp-2.2.12-10.el4_8.4.i386.rpm
cyrus-imapd-utils-2.2.12-10.el4_8.4.i386.rpm
perl-Cyrus-2.2.12-10.el4_8.4.i386.rpm
       x86_64:
cyrus-imapd-2.2.12-10.el4_8.4.x86_64.rpm
cyrus-imapd-devel-2.2.12-10.el4_8.4.x86_64.rpm
cyrus-imapd-murder-2.2.12-10.el4_8.4.x86_64.rpm
cyrus-imapd-nntp-2.2.12-10.el4_8.4.x86_64.rpm
cyrus-imapd-utils-2.2.12-10.el4_8.4.x86_64.rpm
perl-Cyrus-2.2.12-10.el4_8.4.x86_64.rpm

SL 5.x

       SRPMS:
cyrus-imapd-2.3.7-7.el5_4.3.src.rpm
       i386:
cyrus-imapd-2.3.7-7.el5_4.3.i386.rpm
cyrus-imapd-devel-2.3.7-7.el5_4.3.i386.rpm
cyrus-imapd-perl-2.3.7-7.el5_4.3.i386.rpm
cyrus-imapd-utils-2.3.7-7.el5_4.3.i386.rpm
       x86_64:
cyrus-imapd-2.3.7-7.el5_4.3.x86_64.rpm
cyrus-imapd-devel-2.3.7-7.el5_4.3.i386.rpm
cyrus-imapd-devel-2.3.7-7.el5_4.3.x86_64.rpm
cyrus-imapd-perl-2.3.7-7.el5_4.3.x86_64.rpm
cyrus-imapd-utils-2.3.7-7.el5_4.3.x86_64.rpm

-Connie Sieh
-Troy Dawson
lastline