Bug 1717828 (CVE-2019-11356)
| Summary: | CVE-2019-11356 cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | code, j, mailinglists, pzhukov, vanmeeuwen+fedora, zdohnal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | cyrus-imapd 2.5.13, cyrus-imapd 3.0.10 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the CalDAV feature in httpd in Cyrus IMAP. This flaw allows a remote attacker to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-07-15 14:40:41 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1717829, 1718194, 1718195 | ||
| Bug Blocks: | 1717830 | ||
|
Description
Marian Rehak
2019-06-06 09:47:31 UTC
Created cyrus-imapd tracking bugs for this issue: Affects: fedora-all [bug 1717829] Exploitation of this flaw would need a calendar with a specially crafted property name longer than 256 characters. A HTTP PUT operation for a event on such a calendar would cause a stack-based buffer overflow of the propname stack variable. Successful exploitation would actually need some sort of shell code to be included in the calendar property name, which seems too far fetched, therefore successful remote code execution is difficult to achieve in this case. Fixed upstream in 2.5.13 and 3.0.10: https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.html https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:1771 https://access.redhat.com/errata/RHSA-2019:1771 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11356 |