Bug 1717828 (CVE-2019-11356) - CVE-2019-11356 cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
Summary: CVE-2019-11356 cyrus-imapd: buffer overflow in CalDAV request handling trigge...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-11356
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1717829 1718194 1718195
Blocks: 1717830
TreeView+ depends on / blocked
 
Reported: 2019-06-06 09:47 UTC by Marian Rehak
Modified: 2020-04-29 14:14 UTC (History)
6 users (show)

Fixed In Version: cyrus-imapd 2.5.13, cyrus-imapd 3.0.10
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the CalDAV feature in httpd in Cyrus IMAP. This flaw allows a remote attacker to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Clone Of:
Environment:
Last Closed: 2019-07-15 14:40:41 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1771 0 None None None 2019-07-15 09:15:34 UTC

Description Marian Rehak 2019-06-06 09:47:31 UTC 
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Upstream patch:

https://github.com/cyrusimap/cyrus-imapd/commit/a5779db8163b99463e25e7c476f9cbba438b65f3
Comment 1 Marian Rehak 2019-06-06 09:47:43 UTC 
Created cyrus-imapd tracking bugs for this issue:

Affects: fedora-all [bug 1717829]
Comment 2 Huzaifa S. Sidhpurwala 2019-06-07 08:33:06 UTC 
Exploitation of this flaw would need a calendar with a specially crafted property name longer than 256 characters. A HTTP PUT operation for a event on such a calendar would cause a stack-based buffer overflow of the propname stack variable. Successful exploitation would actually need some sort of shell code to be included in the calendar property name, which seems too far fetched, therefore successful remote code execution is difficult to achieve in this case.
Comment 4 Tomas Hoger 2019-06-11 21:00:24 UTC 
Fixed upstream in 2.5.13 and 3.0.10:

https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.html
https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html
Comment 5 errata-xmlrpc 2019-07-15 09:15:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1771 https://access.redhat.com/errata/RHSA-2019:1771
Comment 6 Product Security DevOps Team 2019-07-15 14:40:41 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11356
Note You need to log in before you can comment on or make changes to this bug.