Bug 1491236 (CVE-2017-14230) - CVE-2017-14230 cyrus-imapd: Off-by-one error in prefix calculation in the mboxlist_do_find function
Summary: CVE-2017-14230 cyrus-imapd: Off-by-one error in prefix calculation in the mbo...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-14230
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1491237
Blocks: 1491238
TreeView+ depends on / blocked
 
Reported: 2017-09-13 11:36 UTC by Andrej Nemec
Modified: 2019-09-29 14:22 UTC (History)
6 users (show)

Fixed In Version: cyrus-imapd 3.0.4
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-09-15 08:13:36 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2017-09-13 11:36:11 UTC 
In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obtain sensitive information or cause a denial of service (daemon crash) via a 'LIST "" "Other Users"' command.

Upstream issue:

https://github.com/cyrusimap/cyrus-imapd/issues/2132

Upstream patch:

https://github.com/cyrusimap/cyrus-imapd/commit/6bd33275368edfa71ae117de895488584678ac79
Comment 1 Andrej Nemec 2017-09-13 11:37:13 UTC 
Created cyrus-imapd tracking bugs for this issue:

Affects: fedora-25 [bug 1491237]
Comment 2 Jason Tibbitts 2017-09-13 15:13:22 UTC 
My understanding was that this issue was not present previous to version 3.0.0, and thus Fedora 25 needs no fix.
Comment 3 Andrej Nemec 2017-09-14 07:13:52 UTC 
(In reply to Jason Tibbitts from comment #2)
> My understanding was that this issue was not present previous to version
> 3.0.0, and thus Fedora 25 needs no fix.

This seems to hold true, thanks for closing the fedora bug. Let us finish the deeper analysis of cyrus-imapd in RHEL, then we'll close this one as well.
Comment 4 Pedro Yóssis Silva Barbosa 2017-09-26 15:55:20 UTC 
This issue did not affect the versions of cyrus-imapd as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Note You need to log in before you can comment on or make changes to this bug.