NASLDB: Mandriva Linux Security Advisory : cyrus-imapd (MDVSA-2011:149)
General
ID: 56525
Name: Mandriva Linux Security Advisory : cyrus-imapd (MDVSA-2011:149)
Summary: Checks rpm output for the updated packages
Credits: Tenable Network Security, Inc.
Classification
Risk: –
CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Temporal Vector: –
Port: 0
Family: Mandriva Local Security Checks
Type: Local
Description
Multiple vulnerabilities has been discovered and corrected in
cyrus-imapd :
Stack-based buffer overflow in the split_wildmats function in nntpd.c
in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11
allows remote attackers to execute arbitrary code via a crafted NNTP
command (CVE-2011-3208).
Secunia Research has discovered a vulnerability in Cyrus IMAPd, which
can be exploited by malicious people to bypass certain security
restrictions. The vulnerability is caused due to an error within the
authentication mechanism of the NNTP server, which can be exploited to
bypass the authentication process and execute commands intended for
authenticated users by sending an AUTHINFO USER command without a
following AUTHINFO PASS command (CVE-2011-3372).
Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490
The updated packages have been patched to correct these issues.
Exploiting
Exploit Available: –
Exploitability Ease: –
Sources
CVE: CVE-2011-3208
OSVDB: –
Bugtraq: –
scipID: –
Timeline
Vulnerability Disclosure: –
Patch Release: 2011/10/14
Plugin Release: 2011/10/17
Plugin
Version: 1.2
Filename: mandriva_MDVSA-2011-149.nasl
Filesize: 5552 bytes
MD5 Hash: 453345136f1decf0fb6a4beead1e792f
Identification: Host/local_checks_enabled
Require Keys: Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list
Dependencies: "ssh_get_info.nasl"
Copyright: This script is Copyright© 2011-2012 Tenable Network Security, Inc.
- Letzte Plugins
- USN-1611-1 : thunderbird vulnerabilities
- USN-1610-1 : linux vulnerability
- USN-1609-1 : linux-ti-omap4 vulnerability
- SuSE 10 Security Update : PostgreSQL
- RHSA-2012-1364: bind97
- RHSA-2012-1363: bind
- RHSA-2012-1362: thunderbird
- RHSA-2012-1361: xulrunner
- Mandriva Linux Security Advisory : graphicsmagick
- FreeBSD : phpMyAdmin — Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack