概述

Moderate: cyrus-imapd security update

类型/严重性

Security Advisory: Moderate

标题

Updated cyrus-imapd packages that fix one security issue are now available
for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

描述

The cyrus-imapd packages contain a high-performance mail server with IMAP,
POP3, NNTP, and Sieve support.

It was discovered that cyrus-imapd did not flush the received commands
buffer after switching to TLS encryption for IMAP, LMTP, NNTP, and POP3
sessions. A man-in-the-middle attacker could use this flaw to inject
protocol commands into a victim's TLS session initialization messages. This
could lead to those commands being processed by cyrus-imapd, potentially
allowing the attacker to steal the victim's mail or authentication
credentials. (CVE-2011-1926)

Users of cyrus-imapd are advised to upgrade to these updated packages,
which contain a backported patch to correct this issue. After installing
the update, cyrus-imapd will be restarted automatically.

解决方案

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

受影响的产品

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 6.1 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 6.1 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Server - AUS 5.6 ia64
• Red Hat Enterprise Linux Server - AUS 5.6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.1 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.1 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.1 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.1 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 i386
• Red Hat Virtual Storage Appliance (from RHUI) 6.1 x86_64
• Red Hat Enterprise Linux Server - AUS 5.6 x86_64

修复

• BZ - 705288 - CVE-2011-1926 cyrus-imapd: STARTTLS plaintext command injection

CVE

• CVE-2011-1926

参考

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
x86_64
cyrus-imapd-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: fc947113360f20bdf15f4f09dd1021537715e789b6783e8ae7de4943f8661a9c
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a
cyrus-imapd-devel-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 3ae1f2b72800a327c8dd037721e37d892a0891363c93a263c16682028d50609e
cyrus-imapd-perl-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 60b4cbe2de1f2feb1035ca2348e895cb54fb5aabb653deb164df18beffefca90
cyrus-imapd-utils-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 319228a8da133bb79bb90faaa9bc7e2e4b10cd61d11868866c2141673d9909cb
i386
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a

Red Hat Enterprise Linux Server - Extended Update Support 5.6

SRPM
x86_64
cyrus-imapd-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: fc947113360f20bdf15f4f09dd1021537715e789b6783e8ae7de4943f8661a9c
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a
cyrus-imapd-devel-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 3ae1f2b72800a327c8dd037721e37d892a0891363c93a263c16682028d50609e
cyrus-imapd-perl-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 60b4cbe2de1f2feb1035ca2348e895cb54fb5aabb653deb164df18beffefca90
cyrus-imapd-utils-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 319228a8da133bb79bb90faaa9bc7e2e4b10cd61d11868866c2141673d9909cb
i386
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a

Red Hat Enterprise Linux Workstation 5

SRPM
i386
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a
x86_64
cyrus-imapd-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: fc947113360f20bdf15f4f09dd1021537715e789b6783e8ae7de4943f8661a9c
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a
cyrus-imapd-devel-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 3ae1f2b72800a327c8dd037721e37d892a0891363c93a263c16682028d50609e
cyrus-imapd-perl-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 60b4cbe2de1f2feb1035ca2348e895cb54fb5aabb653deb164df18beffefca90
cyrus-imapd-utils-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 319228a8da133bb79bb90faaa9bc7e2e4b10cd61d11868866c2141673d9909cb

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
cyrus-imapd-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: fc947113360f20bdf15f4f09dd1021537715e789b6783e8ae7de4943f8661a9c
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a
cyrus-imapd-devel-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 3ae1f2b72800a327c8dd037721e37d892a0891363c93a263c16682028d50609e
cyrus-imapd-perl-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 60b4cbe2de1f2feb1035ca2348e895cb54fb5aabb653deb164df18beffefca90
cyrus-imapd-utils-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 319228a8da133bb79bb90faaa9bc7e2e4b10cd61d11868866c2141673d9909cb
i386
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6

SRPM
x86_64
cyrus-imapd-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: fc947113360f20bdf15f4f09dd1021537715e789b6783e8ae7de4943f8661a9c
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a
cyrus-imapd-devel-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 3ae1f2b72800a327c8dd037721e37d892a0891363c93a263c16682028d50609e
cyrus-imapd-perl-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 60b4cbe2de1f2feb1035ca2348e895cb54fb5aabb653deb164df18beffefca90
cyrus-imapd-utils-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 319228a8da133bb79bb90faaa9bc7e2e4b10cd61d11868866c2141673d9909cb
i386
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a

Red Hat Enterprise Linux Server - AUS 5.6

SRPM
x86_64
cyrus-imapd-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: fc947113360f20bdf15f4f09dd1021537715e789b6783e8ae7de4943f8661a9c
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a
cyrus-imapd-devel-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 3ae1f2b72800a327c8dd037721e37d892a0891363c93a263c16682028d50609e
cyrus-imapd-perl-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 60b4cbe2de1f2feb1035ca2348e895cb54fb5aabb653deb164df18beffefca90
cyrus-imapd-utils-2.3.7-7.el5_6.4.x86_64.rpm	SHA-256: 319228a8da133bb79bb90faaa9bc7e2e4b10cd61d11868866c2141673d9909cb
i386
cyrus-imapd-devel-2.3.7-7.el5_6.4.i386.rpm	SHA-256: 89692f6453280403faec2d034e6321ec304527443f8856d5e7a6b146faf85b0a