An error in Cyrus IMAP Server allows mailboxes to be created with administrative privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/cyrus-imapd | * | < 3.0.13 | >= 3.0.13 |
The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail server.
An issue was discovered in Cyrus IMAP Server where sieve script uploading is excessively trusted.
A user can use a sieve script to create any mailbox with administrator privileges.
Disable sieve script uploading until the upgrade is complete.
All Cyrus IMAP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-3.0.13"
The Cyrus IMAP Server is affected by multiple vulnerabilities which could potentially lead to the remote execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/cyrus-imapd | * | < 2.4.12 | >= 2.4.12 |
The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail server.
Multiple vulnerabilities have been discovered in the Cyrus IMAP Server. Please review the CVE identifiers referenced below for details.
An unauthenticated local or remote attacker may be able to execute arbitrary code with the privileges of the Cyrus IMAP Server process or cause a Denial of Service.
There is no known workaround at this time.
All Cyrus IMAP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-2.4.12"
An error in the usage of the ssl-cert eclass within multiple ebuilds might allow for disclosure of generated SSL private keys.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/conserver | * | < 8.1.16 | >= 8.1.16 |
| mail-mta/postfix | * | < 2.4.6-r2 | >= 2.4.6-r2, >= 2.3.8-r1 (revision), >= 2.2.11-r1 (revision) |
| net-ftp/netkit-ftpd | * | < 0.17-r7 | >= 0.17-r7 |
| net-im/ejabberd | * | < 1.1.3 | >= 1.1.3 |
| net-irc/unrealircd | * | < 3.2.7-r2 | >= 3.2.7-r2 |
| net-mail/cyrus-imapd | * | < 2.3.9-r1 | >= 2.3.9-r1 |
| net-mail/dovecot | * | < 1.0.10 | >= 1.0.10 |
| net-misc/stunnel | * | < 4.21-r1 | >= 4.21-r1, < 4.0 |
| net-nntp/inn | * | < 2.4.3-r1 | >= 2.4.3-r1 |
The ssl-cert eclass is a code module used by Gentoo ebuilds to generate SSL certificates.
Robin Johnson reported that the docert() function provided by ssl-cert.eclass can be called by source building stages of an ebuild, such as src_compile() or src_install(), which will result in the generated SSL keys being included inside binary packages (binpkgs).
A local attacker could recover the SSL keys from publicly readable binary packages when "emerge" is called with the "--buildpkg (-b)" or "--buildpkgonly (-B)" option. Remote attackers can recover these keys if the packages are served to a network. Binary packages built using "quickpkg" are not affected.
Do not use pre-generated SSL keys, but use keys that were generated using a different Certificate Authority.
Upgrading to newer versions of the above packages will neither remove possibly compromised SSL certificates, nor old binary packages. Please remove the certificates installed by Portage, and then emerge an upgrade to the package.
All Conserver users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/conserver-8.1.16"
All Postfix 2.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.4.6-r2"
All Postfix 2.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.3.8-r1"
All Postfix 2.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.2.11-r1"
All Netkit FTP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-ftp/netkit-ftpd-0.17-r7"
All ejabberd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-im/ejabberd-1.1.3"
All UnrealIRCd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/unrealircd-3.2.7-r2"
All Cyrus IMAP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-2.3.9-r1"
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.0.10"
All stunnel 4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/stunnel-4.21"
All InterNetNews users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nntp/inn-2.4.3-r1"
The Cyrus IMAP Server is affected by several overflow vulnerabilities which could potentially lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/cyrus-imapd | * | < 2.2.12 | >= 2.2.12 |
The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail server.
Possible single byte overflows have been found in the imapd annotate extension and mailbox handling code. Furthermore stack buffer overflows have been found in fetchnews, the backend and imapd.
An attacker, who could be an authenticated user or an admin of a peering news server, could exploit these vulnerabilities to execute arbitrary code with the rights of the user running the Cyrus IMAP Server.
There is no known workaround at this time.
All Cyrus IMAP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-2.2.12"
The Cyrus IMAP Server contains multiple vulnerabilities which could lead to remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/cyrus-imapd | * | < 2.2.10 | >= 2.2.10 |
The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail server.
Multiple vulnerabilities have been discovered in the argument parsers of the 'partial' and 'fetch' commands of the Cyrus IMAP Server (CAN-2004-1012, CAN-2004-1013). There are also buffer overflows in the 'imap magic plus' code that are vulnerable to exploitation as well (CAN-2004-1011, CAN-2004-1015).
An attacker can exploit these vulnerabilities to execute arbitrary code with the rights of the user running the Cyrus IMAP Server.
There is no known workaround at this time.
All Cyrus-IMAP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-2.2.10"