CVE-2011-1926: Command Injection
First published: Tue May 17 2011(Updated: )
It was found, that Cyrus IMAP recognized IMAP, LMTP, NNTP and POP3 protocol commands during plaintex to TLS session switch (by TLS protocol initialization). A remote attacker could use this flaw to insert plaintext, protocol relevant, commands into TLS protocol initialization messages, leading to execution of these commands during the ciphertext protocol phase, potentially allowing the attacker to steal the victim's mail or authentication credentials. References: [1] <a href="http://www.kb.cert.org/vuls/id/555316">http://www.kb.cert.org/vuls/id/555316</a> [2] <a href="http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423">http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423</a> Relevant upstream patch: [3] <a href="http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162">http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cyrus IMAP Server | =2.2.12 | |
| Cyrus IMAP Server | =2.3.13 | |
| Cyrus IMAP Server | =2.2.13p1 | |
| Cyrus IMAP Server | =2.3.12 | |
| Cyrus IMAP Server | =2.4.1 | |
| Cyrus IMAP Server | =2.1.17 | |
| Cyrus IMAP Server | =2.4.5 | |
| Cyrus IMAP Server | =2.3.6 | |
| Cyrus IMAP Server | =2.3.0 | |
| Cyrus IMAP Server | =2.2.11 | |
| Cyrus IMAP Server | =2.3.14 | |
| Cyrus IMAP Server | =2.3.2 | |
| Cyrus IMAP Server | <=2.4.6 | |
| Cyrus IMAP Server | =2.4.0 | |
| Cyrus IMAP Server | =2.3.11 | |
| Cyrus IMAP Server | =2.3.8 | |
| Cyrus IMAP Server | =2.3.5 | |
| Cyrus IMAP Server | =2.2.9 | |
| Cyrus IMAP Server | =2.4.3 | |
| Cyrus IMAP Server | =2.4.4 | |
| Cyrus IMAP Server | =2.3.9 | |
| Cyrus IMAP Server | =2.3.10 | |
| Cyrus IMAP Server | =2.2.13 | |
| Cyrus IMAP Server | =2.1.16 | |
| Cyrus IMAP Server | =2.3.7 | |
| Cyrus IMAP Server | =2.2.8 | |
| Cyrus IMAP Server | =2.3.16 | |
| Cyrus IMAP Server | =2.0.17 | |
| Cyrus IMAP Server | =2.3.1 | |
| Cyrus IMAP Server | =2.4.2 | |
| Cyrus IMAP Server | =2.3.4 | |
| Cyrus IMAP Server | =2.2.10 | |
| Cyrus IMAP Server | =2.1.18 | |
| Cyrus IMAP Server | =2.3.3 | |
| Cyrus IMAP Server | =2.3.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423
- http://www.kb.cert.org/vuls/id/555316
- http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php
- https://bugzilla.redhat.com/show_bug.cgi?id=705288
- http://openwall.com/lists/oss-security/2011/05/17/15
- http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424
- http://openwall.com/lists/oss-security/2011/05/17/2
- http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162
- http://www.debian.org/security/2011/dsa-2242
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:100
- http://secunia.com/advisories/44670
- http://secunia.com/advisories/44913
- http://www.debian.org/security/2011/dsa-2258
- http://www.redhat.com/support/errata/RHSA-2011-0859.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061415.html
- http://www.securitytracker.com/id?1025625
- http://secunia.com/advisories/44928
- http://secunia.com/advisories/44876
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67867
- http://www.openwall.com/lists/oss-security/2011/05/17/2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=705294
- https://access.redhat.com/security/cve/CVE-2011-1926
- https://rhn.redhat.com/errata/RHSA-2011-0859.html
Frequently Asked Questions
What is the severity of CVE-2011-1926?
CVE-2011-1926 has a moderate severity rating due to its potential to allow remote attackers to execute arbitrary commands during a TLS session.
How do I fix CVE-2011-1926?
To fix CVE-2011-1926, update Cyrus IMAP Server to version 2.4.6 or later, which addresses this vulnerability.
What versions of Cyrus IMAP Server are affected by CVE-2011-1926?
CVE-2011-1926 affects Cyrus IMAP Server versions 2.0.17 through 2.4.5.
Can CVE-2011-1926 be exploited remotely?
Yes, CVE-2011-1926 can be exploited remotely by attackers inserting malicious commands during the TLS handshake.
What are the potential consequences of CVE-2011-1926?
The consequences of CVE-2011-1926 may include unauthorized execution of commands resulting in data leakage or additional system compromise.
- agent/type
- agent/references
- agent/remedy
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1926
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/cmu
- canonical/cyrus imap server
- version/cyrus imap server/2.2.12
- version/cyrus imap server/2.3.13
- version/cyrus imap server/2.2.13p1
- version/cyrus imap server/2.3.12
- version/cyrus imap server/2.4.1
- version/cyrus imap server/2.1.17
- version/cyrus imap server/2.4.5
- version/cyrus imap server/2.3.6
- version/cyrus imap server/2.3.0
- version/cyrus imap server/2.2.11
- version/cyrus imap server/2.3.14
- version/cyrus imap server/2.3.2
- version/cyrus imap server/2.4.6
- version/cyrus imap server/2.4.0
- version/cyrus imap server/2.3.11
- version/cyrus imap server/2.3.8
- version/cyrus imap server/2.3.5
- version/cyrus imap server/2.2.9
- version/cyrus imap server/2.4.3
- version/cyrus imap server/2.4.4
- version/cyrus imap server/2.3.9
- version/cyrus imap server/2.3.10
- version/cyrus imap server/2.2.13
- version/cyrus imap server/2.1.16
- version/cyrus imap server/2.3.7
- version/cyrus imap server/2.2.8
- version/cyrus imap server/2.3.16
- version/cyrus imap server/2.0.17
- version/cyrus imap server/2.3.1
- version/cyrus imap server/2.4.2
- version/cyrus imap server/2.3.4
- version/cyrus imap server/2.2.10
- version/cyrus imap server/2.1.18
- version/cyrus imap server/2.3.3
- version/cyrus imap server/2.3.15