Bug 149870

Summary:	CAN-2005-0546 multiple buffer overflows in cyrus-imapd
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	cyrus-imapd	Assignee:	John Dennis <jdennis>
Status:	CLOSED RAWHIDE	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=moderate,public=20050214
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-04-24 16:24:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	156290

Description Josh Bressers 2005-02-28 15:08:22 UTC

+++ This bug was initially created as a clone of Bug #149869 +++

Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to
execute arbitrary code via (1) an off-by-one error in the imapd annotate
extension, (2) an off-by-one error in "cached header handling," (3) a
stack-based buffer overflow in fetchnews, or (4) a stack-based buffer overflow
in imapd.


* Fix possible single byte overflow in mailbox handling code. 
* Fix possible single byte overflows in the imapd annotate extension. 
* Fix stack buffer overflows in fetchnews (exploitable by peer news
  server), backend (exploitable by admin), and in imapd (exploitable
  by users though only on platforms where a filename may be larger
  than a mailbox name).

Comment 1 Josh Bressers 2005-02-28 15:10:46 UTC

This issue should also affect FC2.

Comment 2 John Dennis 2005-04-04 23:10:51 UTC

O.K. version 2.2.12 is in CVS and built. Please note version 2.2.11 referenced
in above annoucement was superceded in hours by 2.2.12 without any statement I
could find as to why, I can only assume because 2.2.11 needed a minor fix, thus
I've upgraded to 2.2.12.

Also note, cyrus-imapd has been deprecated in FC4, however that CVS branch was
updated, but it could not be built because its deprecated. The same upgrade fix
was applied to FC3 and FC2.

Tomorrow I will sanity test the new builds and start the fedora push process.

Comment 3 John Dennis 2005-04-24 16:24:16 UTC

testing completed. package sign and push requested submitted, announcement to
list will follow when packages are signed and pushed. Closing this out...