cyrus, perl security update

2011-06-0820:42:26

CentOS Project

lists.centos.org

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.011 Low

EPSS

Percentile

84.3%

JSON

CentOS Errata and Security Advisory CESA-2011:0859

The cyrus-imapd packages contain a high-performance mail server with IMAP,
POP3, NNTP, and Sieve support.

It was discovered that cyrus-imapd did not flush the received commands
buffer after switching to TLS encryption for IMAP, LMTP, NNTP, and POP3
sessions. A man-in-the-middle attacker could use this flaw to inject
protocol commands into a victim’s TLS session initialization messages. This
could lead to those commands being processed by cyrus-imapd, potentially
allowing the attacker to steal the victim’s mail or authentication
credentials. (CVE-2011-1926)

Users of cyrus-imapd are advised to upgrade to these updated packages,
which contain a backported patch to correct this issue. After installing
the update, cyrus-imapd will be restarted automatically.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2011-August/079835.html
https://lists.centos.org/pipermail/centos-announce/2011-August/079836.html
https://lists.centos.org/pipermail/centos-announce/2011-June/079773.html
https://lists.centos.org/pipermail/centos-announce/2011-June/079774.html

Affected packages:
cyrus-imapd
cyrus-imapd-devel
cyrus-imapd-murder
cyrus-imapd-nntp
cyrus-imapd-perl
cyrus-imapd-utils
perl-Cyrus

Upstream details at:
https://access.redhat.com/errata/RHSA-2011:0859

OSVersionArchitecturePackageVersionFilename
CentOS5x86_64cyrus-imapd< 2.3.7-7.el5_6.4cyrus-imapd-2.3.7-7.el5_6.4.x86_64.rpm
CentOS5i386cyrus-imapd-devel< 2.3.7-7.el5_6.4cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm
CentOS5x86_64cyrus-imapd-devel< 2.3.7-7.el5_6.4cyrus-imapd-devel-2.3.7-7.el5_6.4.x86_64.rpm
CentOS5x86_64cyrus-imapd-perl< 2.3.7-7.el5_6.4cyrus-imapd-perl-2.3.7-7.el5_6.4.x86_64.rpm
CentOS5x86_64cyrus-imapd-utils< 2.3.7-7.el5_6.4cyrus-imapd-utils-2.3.7-7.el5_6.4.x86_64.rpm
CentOS5i386cyrus-imapd< 2.3.7-7.el5_6.4cyrus-imapd-2.3.7-7.el5_6.4.i386.rpm
CentOS5i386cyrus-imapd-devel< 2.3.7-7.el5_6.4cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm
CentOS5i386cyrus-imapd-perl< 2.3.7-7.el5_6.4cyrus-imapd-perl-2.3.7-7.el5_6.4.i386.rpm
CentOS5i386cyrus-imapd-utils< 2.3.7-7.el5_6.4cyrus-imapd-utils-2.3.7-7.el5_6.4.i386.rpm
CentOS4i386cyrus-imapd< 2.2.12-15.el4_8cyrus-imapd-2.2.12-15.el4_8.i386.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	5	x86_64	cyrus-imapd	< 2.3.7-7.el5_6.4	cyrus-imapd-2.3.7-7.el5_6.4.x86_64.rpm
CentOS	5	i386	cyrus-imapd-devel	< 2.3.7-7.el5_6.4	cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm
CentOS	5	x86_64	cyrus-imapd-devel	< 2.3.7-7.el5_6.4	cyrus-imapd-devel-2.3.7-7.el5_6.4.x86_64.rpm
CentOS	5	x86_64	cyrus-imapd-perl	< 2.3.7-7.el5_6.4	cyrus-imapd-perl-2.3.7-7.el5_6.4.x86_64.rpm
CentOS	5	x86_64	cyrus-imapd-utils	< 2.3.7-7.el5_6.4	cyrus-imapd-utils-2.3.7-7.el5_6.4.x86_64.rpm
CentOS	5	i386	cyrus-imapd	< 2.3.7-7.el5_6.4	cyrus-imapd-2.3.7-7.el5_6.4.i386.rpm
CentOS	5	i386	cyrus-imapd-devel	< 2.3.7-7.el5_6.4	cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm
CentOS	5	i386	cyrus-imapd-perl	< 2.3.7-7.el5_6.4	cyrus-imapd-perl-2.3.7-7.el5_6.4.i386.rpm
CentOS	5	i386	cyrus-imapd-utils	< 2.3.7-7.el5_6.4	cyrus-imapd-utils-2.3.7-7.el5_6.4.i386.rpm
CentOS	4	i386	cyrus-imapd	< 2.2.12-15.el4_8	cyrus-imapd-2.2.12-15.el4_8.i386.rpm