National Cyber-Alert System

Vulnerability Summary for CVE-2009-3235

Overview

Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2009-9559

Type: Patch Information

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html

External Source: MLIST

Name: [Dovecot-news] 20090914 Security holes in CMU Sieve plugin

Type: Advisory; Patch Information

Hyperlink:http://dovecot.org/list/dovecot-news/2009-September/000135.html

External Source: XF

Name: cmu-sieve-dovecot-unspecified-bo(53248)

Hyperlink:http://xforce.iss.net/xforce/xfdb/53248

External Source: VUPEN

Name: ADV-2009-3184

Hyperlink:http://www.vupen.com/english/advisories/2009/3184

External Source: VUPEN

Name: ADV-2009-2641

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/2641

External Source: UBUNTU

Name: USN-838-1

Hyperlink:http://www.ubuntu.com/usn/USN-838-1

External Source: BID

Name: 36377

Hyperlink:http://www.securityfocus.com/bid/36377

External Source: OSVDB

Name: 58103

Hyperlink:http://www.osvdb.org/58103

External Source: MLIST

Name: [oss-security] 20090914 Re: CVE for recent cyrus-imap issue

Hyperlink:http://www.openwall.com/lists/oss-security/2009/09/14/3

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3937

Hyperlink:http://support.apple.com/kb/HT3937

External Source: SECUNIA

Name: 36904

Hyperlink:http://secunia.com/advisories/36904

External Source: SECUNIA

Name: 36713

Type: Advisory

Hyperlink:http://secunia.com/advisories/36713

External Source: SECUNIA

Name: 36698

Type: Advisory

Hyperlink:http://secunia.com/advisories/36698

External Source: SUSE

Name: SUSE-SR:2009:018

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html

External Source: SUSE

Name: SUSE-SR:2009:016

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

External Source: APPLE

Name: APPLE-SA-2009-11-09-1

Hyperlink:http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html