- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Moderate: cyrus-imapd security update
Advisory ID:       RHSA-2005:408-01
Advisory URL:      https://access.redhat.com/errata/RHSA-2005:408.html
Issue date:        2005-05-17
Updated on:        2005-05-17
Product:           Red Hat Enterprise Linux
CVE Names:         CAN-2005-0546
- ---------------------------------------------------------------------1. Summary:

Updated cyrus-imapd packages that fix several buffer overflow security
issues are now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

The cyrus-imapd package contains the core of the Cyrus IMAP server.

Several buffer overflow bugs were found in cyrus-imapd. It is possible that
an authenticated malicious user could cause the imap server to crash.
Additionally, a peer news admin could potentially execute arbitrary code on
the imap server when news is received using the fetchnews command. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2005-0546 to this issue.

Users of cyrus-imapd are advised to upgrade to these updated packages, which
contain cyrus-imapd version 2.2.12 to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
4b3fa71b394dbd0e8c87a29c5a56b286  cyrus-imapd-2.2.12-3.RHEL4.1.src.rpm

i386:
68c478ca17ecb402c8d6044a08fbbf97  cyrus-imapd-2.2.12-3.RHEL4.1.i386.rpm
b0e73a633a3f420cb7c1b3201bbb6ab4  cyrus-imapd-devel-2.2.12-3.RHEL4.1.i386.rpm
0b417a838fde38c48e118bbae7adb5de  cyrus-imapd-murder-2.2.12-3.RHEL4.1.i386.rpm
60d37f09e9b5db67a90b26d899eef10e  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.i386.rpm
125973b27ff9c214fdcade6adfbbab4c  cyrus-imapd-utils-2.2.12-3.RHEL4.1.i386.rpm
adf11c07b7572a803fba0694b10a9bf3  perl-Cyrus-2.2.12-3.RHEL4.1.i386.rpm

ia64:
47e38551bf642b9f3c950e4d73014963  cyrus-imapd-2.2.12-3.RHEL4.1.ia64.rpm
4c7ca20e0b41290767236bc7cebced40  cyrus-imapd-devel-2.2.12-3.RHEL4.1.ia64.rpm
892adc82d6b337d5b838de06b31f6005  cyrus-imapd-murder-2.2.12-3.RHEL4.1.ia64.rpm
2d15fe37eaa0e6e82294b2fb4448824c  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.ia64.rpm
e7d894fce5d9dfe8f17fcdbbd80280ee  cyrus-imapd-utils-2.2.12-3.RHEL4.1.ia64.rpm
0d5ce4154308b7ad7796c9517c1b6fcd  perl-Cyrus-2.2.12-3.RHEL4.1.ia64.rpm

ppc:
0cf0e912e3d10a013f875ca75f6ed117  cyrus-imapd-2.2.12-3.RHEL4.1.ppc.rpm
76e6a47a7b15caf6bdf770d8c8e9ceb2  cyrus-imapd-devel-2.2.12-3.RHEL4.1.ppc.rpm
c70639b4245a12ccc5d7d81cbe8a8262  cyrus-imapd-murder-2.2.12-3.RHEL4.1.ppc.rpm
9aa309aef2579944259cb7ffe8245488  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.ppc.rpm
f1c85a497a0e80e1ceaa146b2e78a742  cyrus-imapd-utils-2.2.12-3.RHEL4.1.ppc.rpm
cc16c62094b302d9411f3be1ee38ab09  perl-Cyrus-2.2.12-3.RHEL4.1.ppc.rpm

s390:
f7dc2f55144bb5f4fc608811f80323a0  cyrus-imapd-2.2.12-3.RHEL4.1.s390.rpm
f1b97671e20f3af01272f848b42f254e  cyrus-imapd-devel-2.2.12-3.RHEL4.1.s390.rpm
00103a5a070125fd21b8e474bf321ec1  cyrus-imapd-murder-2.2.12-3.RHEL4.1.s390.rpm
e49e2d04a077d8f7478eb0f0d43fe91e  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.s390.rpm
0918d048e49457ece8c2e772a0ff2a2b  cyrus-imapd-utils-2.2.12-3.RHEL4.1.s390.rpm
9dcb24d38c2bc3f5506a742e526f2ebc  perl-Cyrus-2.2.12-3.RHEL4.1.s390.rpm

s390x:
45b6b8d9c21885c76263dc59b3b8e612  cyrus-imapd-2.2.12-3.RHEL4.1.s390x.rpm
624f870b32646960b4b02b0b38395f0c  cyrus-imapd-devel-2.2.12-3.RHEL4.1.s390x.rpm
3785bb0f2410fbecdd19b0c4d006ad19  cyrus-imapd-murder-2.2.12-3.RHEL4.1.s390x.rpm
3b5acbdc0b46d079e033ecb1c7f5702c  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.s390x.rpm
27a4e0d1eb725896dad32f01bd29ed58  cyrus-imapd-utils-2.2.12-3.RHEL4.1.s390x.rpm
2f229a87ffcf945db5fece6ef5f1882b  perl-Cyrus-2.2.12-3.RHEL4.1.s390x.rpm

x86_64:
66c83d5825b3487300365d4d5d6f65f9  cyrus-imapd-2.2.12-3.RHEL4.1.x86_64.rpm
bae570996e911c09e130cfafbd006ae7  cyrus-imapd-devel-2.2.12-3.RHEL4.1.x86_64.rpm
a665893a93037f024419f31b0647d684  cyrus-imapd-murder-2.2.12-3.RHEL4.1.x86_64.rpm
723ffd10890a8c6ca91496a3d0f66511  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.x86_64.rpm
03b502fd34bc8a1c3bcfcc4d7b987dfb  cyrus-imapd-utils-2.2.12-3.RHEL4.1.x86_64.rpm
f785bfaab819a7fba7ecee0313c85dba  perl-Cyrus-2.2.12-3.RHEL4.1.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
4b3fa71b394dbd0e8c87a29c5a56b286  cyrus-imapd-2.2.12-3.RHEL4.1.src.rpm

i386:
68c478ca17ecb402c8d6044a08fbbf97  cyrus-imapd-2.2.12-3.RHEL4.1.i386.rpm
b0e73a633a3f420cb7c1b3201bbb6ab4  cyrus-imapd-devel-2.2.12-3.RHEL4.1.i386.rpm
0b417a838fde38c48e118bbae7adb5de  cyrus-imapd-murder-2.2.12-3.RHEL4.1.i386.rpm
60d37f09e9b5db67a90b26d899eef10e  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.i386.rpm
125973b27ff9c214fdcade6adfbbab4c  cyrus-imapd-utils-2.2.12-3.RHEL4.1.i386.rpm
adf11c07b7572a803fba0694b10a9bf3  perl-Cyrus-2.2.12-3.RHEL4.1.i386.rpm

x86_64:
66c83d5825b3487300365d4d5d6f65f9  cyrus-imapd-2.2.12-3.RHEL4.1.x86_64.rpm
bae570996e911c09e130cfafbd006ae7  cyrus-imapd-devel-2.2.12-3.RHEL4.1.x86_64.rpm
a665893a93037f024419f31b0647d684  cyrus-imapd-murder-2.2.12-3.RHEL4.1.x86_64.rpm
723ffd10890a8c6ca91496a3d0f66511  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.x86_64.rpm
03b502fd34bc8a1c3bcfcc4d7b987dfb  cyrus-imapd-utils-2.2.12-3.RHEL4.1.x86_64.rpm
f785bfaab819a7fba7ecee0313c85dba  perl-Cyrus-2.2.12-3.RHEL4.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
4b3fa71b394dbd0e8c87a29c5a56b286  cyrus-imapd-2.2.12-3.RHEL4.1.src.rpm

i386:
68c478ca17ecb402c8d6044a08fbbf97  cyrus-imapd-2.2.12-3.RHEL4.1.i386.rpm
b0e73a633a3f420cb7c1b3201bbb6ab4  cyrus-imapd-devel-2.2.12-3.RHEL4.1.i386.rpm
0b417a838fde38c48e118bbae7adb5de  cyrus-imapd-murder-2.2.12-3.RHEL4.1.i386.rpm
60d37f09e9b5db67a90b26d899eef10e  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.i386.rpm
125973b27ff9c214fdcade6adfbbab4c  cyrus-imapd-utils-2.2.12-3.RHEL4.1.i386.rpm
adf11c07b7572a803fba0694b10a9bf3  perl-Cyrus-2.2.12-3.RHEL4.1.i386.rpm

ia64:
47e38551bf642b9f3c950e4d73014963  cyrus-imapd-2.2.12-3.RHEL4.1.ia64.rpm
4c7ca20e0b41290767236bc7cebced40  cyrus-imapd-devel-2.2.12-3.RHEL4.1.ia64.rpm
892adc82d6b337d5b838de06b31f6005  cyrus-imapd-murder-2.2.12-3.RHEL4.1.ia64.rpm
2d15fe37eaa0e6e82294b2fb4448824c  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.ia64.rpm
e7d894fce5d9dfe8f17fcdbbd80280ee  cyrus-imapd-utils-2.2.12-3.RHEL4.1.ia64.rpm
0d5ce4154308b7ad7796c9517c1b6fcd  perl-Cyrus-2.2.12-3.RHEL4.1.ia64.rpm

x86_64:
66c83d5825b3487300365d4d5d6f65f9  cyrus-imapd-2.2.12-3.RHEL4.1.x86_64.rpm
bae570996e911c09e130cfafbd006ae7  cyrus-imapd-devel-2.2.12-3.RHEL4.1.x86_64.rpm
a665893a93037f024419f31b0647d684  cyrus-imapd-murder-2.2.12-3.RHEL4.1.x86_64.rpm
723ffd10890a8c6ca91496a3d0f66511  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.x86_64.rpm
03b502fd34bc8a1c3bcfcc4d7b987dfb  cyrus-imapd-utils-2.2.12-3.RHEL4.1.x86_64.rpm
f785bfaab819a7fba7ecee0313c85dba  perl-Cyrus-2.2.12-3.RHEL4.1.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
4b3fa71b394dbd0e8c87a29c5a56b286  cyrus-imapd-2.2.12-3.RHEL4.1.src.rpm

i386:
68c478ca17ecb402c8d6044a08fbbf97  cyrus-imapd-2.2.12-3.RHEL4.1.i386.rpm
b0e73a633a3f420cb7c1b3201bbb6ab4  cyrus-imapd-devel-2.2.12-3.RHEL4.1.i386.rpm
0b417a838fde38c48e118bbae7adb5de  cyrus-imapd-murder-2.2.12-3.RHEL4.1.i386.rpm
60d37f09e9b5db67a90b26d899eef10e  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.i386.rpm
125973b27ff9c214fdcade6adfbbab4c  cyrus-imapd-utils-2.2.12-3.RHEL4.1.i386.rpm
adf11c07b7572a803fba0694b10a9bf3  perl-Cyrus-2.2.12-3.RHEL4.1.i386.rpm

ia64:
47e38551bf642b9f3c950e4d73014963  cyrus-imapd-2.2.12-3.RHEL4.1.ia64.rpm
4c7ca20e0b41290767236bc7cebced40  cyrus-imapd-devel-2.2.12-3.RHEL4.1.ia64.rpm
892adc82d6b337d5b838de06b31f6005  cyrus-imapd-murder-2.2.12-3.RHEL4.1.ia64.rpm
2d15fe37eaa0e6e82294b2fb4448824c  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.ia64.rpm
e7d894fce5d9dfe8f17fcdbbd80280ee  cyrus-imapd-utils-2.2.12-3.RHEL4.1.ia64.rpm
0d5ce4154308b7ad7796c9517c1b6fcd  perl-Cyrus-2.2.12-3.RHEL4.1.ia64.rpm

x86_64:
66c83d5825b3487300365d4d5d6f65f9  cyrus-imapd-2.2.12-3.RHEL4.1.x86_64.rpm
bae570996e911c09e130cfafbd006ae7  cyrus-imapd-devel-2.2.12-3.RHEL4.1.x86_64.rpm
a665893a93037f024419f31b0647d684  cyrus-imapd-murder-2.2.12-3.RHEL4.1.x86_64.rpm
723ffd10890a8c6ca91496a3d0f66511  cyrus-imapd-nntp-2.2.12-3.RHEL4.1.x86_64.rpm
03b502fd34bc8a1c3bcfcc4d7b987dfb  cyrus-imapd-utils-2.2.12-3.RHEL4.1.x86_64.rpm
f785bfaab819a7fba7ecee0313c85dba  perl-Cyrus-2.2.12-3.RHEL4.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

6. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0546

7. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.