Cyrus IMAP Server: Multiple remote vulnerabilities The Cyrus IMAP Server contains multiple vulnerabilities which could lead to remote execution of arbitrary code. cyrus-imapd November 25, 2004 November 25, 2004: 01 72194 remote 2.2.10 2.2.10

The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail server.

Multiple vulnerabilities have been discovered in the argument parsers of the 'partial' and 'fetch' commands of the Cyrus IMAP Server (CAN-2004-1012, CAN-2004-1013). There are also buffer overflows in the 'imap magic plus' code that are vulnerable to exploitation as well (CAN-2004-1011, CAN-2004-1015).

An attacker can exploit these vulnerabilities to execute arbitrary code with the rights of the user running the Cyrus IMAP Server.

There is no known workaround at this time.

All Cyrus-IMAP Server users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-2.2.10" CAN-2004-1011 CAN-2004-1012 CAN-2004-1013 CAN-2004-1015 e-matters Advisory Cyrus IMAP Server ChangeLog koon lewk lewk