Bug 385729 – <net-mail/cyrus-imapd-2.4.12 multiple vulnerabilities (CVE-2011-3372)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2011-10-05 12:13:24 UTC]

From secunia security advisor at $URL:

Description:
The vulnerability is caused due to an error within the authentication mechanism of the NNTP server, which can be exploited to bypass the authentication process and execute commands intended for authenticated users by sending an "AUTHINFO USER" command without a following "AUTHINFO PASS" command.

The vulnerability is confirmed in version 2.4.10 and 2.4.11. Prior versions may also be affected.

Solution:
Apply patch or update to version 2.4.12.

[Comment 1 Agostino Sarubbo 2011-10-05 12:16:01 UTC]

Please bump 2.4.12 or here[1] is the patch.

[1]: http://git.cyrusimap.org/cyrus-imapd/patch/?id=77903669e04c9788460561dd0560b9c916519594

[Comment 2 Eray Aslan 2011-10-06 11:22:15 UTC]

+*cyrus-imapd-2.4.12 (06 Oct 2011)
+
+  06 Oct 2011; Eray Aslan <[e-mail]> +cyrus-imapd-2.4.12.ebuild:
+  version bump - security bug #385729. Add back sieve USE flag - bug #382389
+

@security:  We can stabilize =net-mail/cyrus-imapd-2.4.12.  Thank you.

[Comment 3 Agostino Sarubbo 2011-10-06 12:35:39 UTC]

(In reply to comment #2)
> @security:  We can stabilize =net-mail/cyrus-imapd-2.4.12.  Thank you.

Thanks Eras.

Arches, please test and mark stable: 

=net-mail/cyrus-imapd-2.4.12

target KEYWORDS : "amd64 hppa ppc ppc64 sparc x86"

[Comment 4 Agostino Sarubbo 2011-10-06 12:54:02 UTC]

amd64 ok

[Comment 5 Ian Delaney (RETIRED) 2011-10-06 19:06:32 UTC]

ditto

[Comment 6 Steve Dibb (RETIRED) 2011-10-06 20:00:22 UTC]

Thanks, guys

+  06 Oct 2011; Steve Dibb <[e-mail]> cyrus-imapd-2.4.12.ebuild:
+  amd64 stable, security bug 385729

[Comment 7 GLSAMaker/CVETool Bot 2011-10-08 00:56:49 UTC]

CVE-2011-3481 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3481):
  The index_get_ids function in index.c in imapd in Cyrus IMAP Server before
  2.4.11, when server-side threading is enabled, allows remote attackers to
  cause a denial of service (NULL pointer dereference and daemon crash) via a
  crafted References header in an e-mail message.

[Comment 8 Agostino Sarubbo 2011-10-08 10:15:13 UTC]

*** Bug 386233 has been marked as a duplicate of this bug. ***

[Comment 9 Raúl Porcel (RETIRED) 2011-10-08 18:15:53 UTC]

sparc stable

[Comment 10 Paweł Hajdan, Jr. (RETIRED) 2011-10-08 19:33:40 UTC]

x86 stable

[Comment 11 Kacper Kowalik (Xarthisius) (RETIRED) 2011-10-09 18:22:50 UTC]

ppc/ppc64 stable

[Comment 12 Jeroen Roovers (RETIRED) 2011-10-11 19:04:24 UTC]

Stable for HPPA.

[Comment 13 Tim Sammut (RETIRED) 2011-10-11 19:06:08 UTC]

Thanks, everyone. GLSA Vote: yes.

[Comment 14 Stefan Behte (RETIRED) 2011-10-11 19:56:48 UTC]

Vote: YES. GLSA request filed.

[Comment 15 GLSAMaker/CVETool Bot 2011-10-22 04:34:18 UTC]

This issue was resolved and addressed in
 GLSA 201110-16 at http://security.gentoo.org/glsa/glsa-201110-16.xml
by GLSA coordinator Tim Sammut (underling).

[Comment 16 GLSAMaker/CVETool Bot 2012-02-21 03:56:13 UTC]

CVE-2011-3372 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3372):
  imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12
  allows remote attackers to bypass authentication by sending an AUTHINFO USER
  command without sending an additional AUTHINFO PASS command.