Bug 1717828 (CVE-2019-11356)

Summary: CVE-2019-11356 cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: code, j, mailinglists, pzhukov, vanmeeuwen+fedora, zdohnal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: cyrus-imapd 2.5.13, cyrus-imapd 3.0.10 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the CalDAV feature in httpd in Cyrus IMAP. This flaw allows a remote attacker to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-15 14:40:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1717829, 1718194, 1718195    
Bug Blocks: 1717830    

Description Marian Rehak 2019-06-06 09:47:31 UTC
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Upstream patch:

https://github.com/cyrusimap/cyrus-imapd/commit/a5779db8163b99463e25e7c476f9cbba438b65f3

Comment 1 Marian Rehak 2019-06-06 09:47:43 UTC
Created cyrus-imapd tracking bugs for this issue:

Affects: fedora-all [bug 1717829]

Comment 2 Huzaifa S. Sidhpurwala 2019-06-07 08:33:06 UTC
Exploitation of this flaw would need a calendar with a specially crafted property name longer than 256 characters. A HTTP PUT operation for a event on such a calendar would cause a stack-based buffer overflow of the propname stack variable. Successful exploitation would actually need some sort of shell code to be included in the calendar property name, which seems too far fetched, therefore successful remote code execution is difficult to achieve in this case.

Comment 5 errata-xmlrpc 2019-07-15 09:15:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1771 https://access.redhat.com/errata/RHSA-2019:1771

Comment 6 Product Security DevOps Team 2019-07-15 14:40:41 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11356