Test ID:	1.3.6.1.4.1.25623.1.0.880905
Category:	CentOS Local Security Checks
Title:	CentOS Update for cyrus-imapd CESA-2009:1459 centos4 i386
Summary:	The remote host is missing an update for the 'cyrus-imapd'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'cyrus-imapd' package(s) announced via the referenced advisory. Vulnerability Insight: The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support. Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve implementation. An authenticated user able to create Sieve mail filtering rules could use these flaws to execute arbitrary code with the privileges of the Cyrus IMAP server user. (CVE-2009-2632, CVE-2009-3235) Users of cyrus-imapd are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the update, cyrus-imapd will be restarted automatically. Affected Software/OS: cyrus-imapd on CentOS 4 Solution: Please install the updated packages. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-2632 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html BugTraq ID: 36296 http://www.securityfocus.com/bid/36296 BugTraq ID: 36377 http://www.securityfocus.com/bid/36377 Debian Security Information: DSA-1881 (Google Search) http://www.debian.org/security/2009/dsa-1881 https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html https://lists.andrew.cmu.edu/pipermail/cyrus-cvs/2009-September/001253.html https://lists.andrew.cmu.edu/pipermail/cyrus-cvs/2009-September/001254.html http://dovecot.org/list/dovecot-news/2009-September/000135.html http://www.openwall.com/lists/oss-security/2009/09/14/3 http://www.osvdb.org/58103 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10082 http://secunia.com/advisories/36629 http://secunia.com/advisories/36632 http://secunia.com/advisories/36698 http://secunia.com/advisories/36713 http://secunia.com/advisories/36904 SuSE Security Announcement: SUSE-SR:2009:016 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html http://www.ubuntu.com/usn/USN-838-1 http://www.vupen.com/english/advisories/2009/2559 http://www.vupen.com/english/advisories/2009/2641 Common Vulnerability Exposure (CVE) ID: CVE-2009-3235 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515 SuSE Security Announcement: SUSE-SR:2009:018 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html http://www.vupen.com/english/advisories/2009/3184 XForce ISS Database: cmu-sieve-dovecot-unspecified-bo(53248) https://exchange.xforce.ibmcloud.com/vulnerabilities/53248
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.