diff options
| author | Jacques Vidrine <nectar@FreeBSD.org> | 2004-05-12 15:28:50 +0000 |
|---|---|---|
| committer | Jacques Vidrine <nectar@FreeBSD.org> | 2004-05-12 15:28:50 +0000 |
| commit | 31fab7e6c9cfbff3adbb78dd96cb44de33fb690e (patch) | |
| tree | be28c6e03700ce14b84f3cdd89f61f86e447f99f /security/vuxml | |
| parent | update to 0.2.8 (diff) | |
Add old Cyrus IMAP server heap buffer overflow.
Reported by: eik
Notes
Notes:
svn path=/head/; revision=109011
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index d3a3b4484bbf..1dcd041ff0e9 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -30,6 +30,41 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="35f6fdf8-a425-11d8-9c6d-0020ed76ef5a"> + <topic>Cyrus IMAP pre-authentication heap overflow vulnerability</topic> + <affects> + <package> + <name>cyrus</name> + <range><lt>2.0.17</lt></range> + <range><ge>2.1</ge><lt>2.1.11</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>In December 2002, Timo Sirainen reported:</p> + <blockquote + cite="http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605"> + <p>Cyrus IMAP server has a a remotely exploitable pre-login + buffer overflow. [...] Note that you don't have to log in + before exploiting this, and since Cyrus + runs everything under one UID, it's possible to read every + user's mail in the system.</p> + </blockquote> + <p>It is unknown whether this vulnerability is exploitable for code + execution on FreeBSD systems.</p> + </body> + </description> + <references> + <bid>6298</bid> + <url>http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605</url> + <!-- <mlist msgid="20021202175606.GA26254@irccrew.org">http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605</mlist> --> + </references> + <dates> + <discovery>2002-12-02</discovery> + <entry>2004-05-12</entry> + </dates> + </vuln> + <vuln vid="5f29c2e4-9f6a-11d8-abbc-00e08110b673"> <topic>exim buffer overflow when verify = header_syntax is used</topic> <affects> |