Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via (1) an off-by-one error in the imapd annotate extension, (2) an off-by-one error in "cached header handling," (3) a stack-based buffer overflow in fetchnews, or (4) a stack-based buffer overflow in imapd. * Fix possible single byte overflow in mailbox handling code. * Fix possible single byte overflows in the imapd annotate extension. * Fix stack buffer overflows in fetchnews (exploitable by peer news server), backend (exploitable by admin), and in imapd (exploitable by users though only on platforms where a filename may be larger than a mailbox name).
The upstream announcement is here: http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&msg=33723
O.K. version 2.2.12 is in CVS and built. Please note version 2.2.11 referenced in above annoucement was superceded in hours by 2.2.12 without any statement I could find as to why, I can only assume because 2.2.11 needed a minor fix, thus I've upgraded to 2.2.12. Tomorrow I will do the eratta component of this bug.
errata RHSA-2005:408 generated
version 2.2.12.RHEL4.1 created and entered into errata
modified until pushed.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-408.html