CVE-2019-11356
published 2019-06-03CVE-2019-11356: The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
7.62%
93.9th percentile
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| cyrus | imap | 2.5.0 – 2.5.12 | — |
| cyrus | imap | 3.0.0 – 3.0.9 | — |
| debian | cyrus-imapd | < cyrus-imapd 3.0.8-6 (bookworm) | cyrus-imapd 3.0.8-6 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP PUT requests to CalDAV endpoints containing iCalendar property names exceeding 256 characters in length, which trigger a stack-based buffer overflow of the propname stack variable. ↗
- →Alert on HTTP PUT operations targeting CalDAV feature endpoints in Cyrus IMAP httpd, particularly those with abnormally long iCalendar property names in the request body. ↗
- ·Successful remote code execution is considered difficult in practice; the attacker would need to embed shellcode within the iCalendar property name itself, which is an unusual and constrained attack vector. ↗
- ·Affected versions are Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9; fixed in 2.5.13 and 3.0.10. Red Hat Enterprise Linux 5, 6, and 7 are listed as not affected. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Cyrus IMAP Server vulnerabilities
vendor_ubuntu·2020-10-05·CVSS 9.8
CVE-2019-11356 [CRITICAL] Cyrus IMAP Server vulnerabilities
Title: Cyrus IMAP Server vulnerabilities
Summary: Cyrus IMAP Server could be made to overwrite files as the administrator.
It was dicovered that Cyrus IMAP Server could execute arbitrary code via a
crafted HTTP PUT operation for an event with a long iCalendar property name.
An attacker could use this vulnerability to cause a crash or possibly execute
arbitrary code. (CVE-2019-11356)
It was discovered that the Cyrus IMAP Server allow users to create any
mailbox with administrative privileges. A local attacker could use this to
obtain sensitive information. (CVE-2019-19783)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
vendor_redhat·2019-06-04·CVSS 9.8
CVE-2019-11356 [CRITICAL] CWE-119 cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
A flaw was found in the CalDAV feature in httpd in Cyrus IMAP. This flaw allows a remote attacker to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Package: cyrus-imapd (Red Hat Enterprise Linux 5) - Not affected
Package: cyrus-imapd (Red Hat Enterprise Linux 6) - Not affected
Package: cyrus-imapd (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2019-11356: cyrus-imapd - The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through...
vendor_debian·2019·CVSS 9.8
CVE-2019-11356 [CRITICAL] CVE-2019-11356: cyrus-imapd - The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through...
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Scope: local
bookworm: resolved (fixed in 3.0.8-6)
bullseye: resolved (fixed in 3.0.8-6)
forky: resolved (fixed in 3.0.8-6)
sid: resolved (fixed in 3.0.8-6)
trixie: resolved (fixed in 3.0.8-6)
GHSA
GHSA-v5c4-xfxj-8x84: The CalDAV feature in httpd in Cyrus IMAP 2
ghsa_unreviewed·2022-05-24
CVE-2019-11356 [CRITICAL] CWE-119 GHSA-v5c4-xfxj-8x84: The CalDAV feature in httpd in Cyrus IMAP 2
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
OSV
cyrus-imapd vulnerabilities
osv·2020-10-05·CVSS 9.8
CVE-2019-11356 [CRITICAL] cyrus-imapd vulnerabilities
cyrus-imapd vulnerabilities
It was dicovered that Cyrus IMAP Server could execute arbitrary code via a
crafted HTTP PUT operation for an event with a long iCalendar property name.
An attacker could use this vulnerability to cause a crash or possibly execute
arbitrary code. (CVE-2019-11356)
It was discovered that the Cyrus IMAP Server allow users to create any
mailbox with administrative privileges. A local attacker could use this to
obtain sensitive information. (CVE-2019-19783)
OSV
CVE-2019-11356: The CalDAV feature in httpd in Cyrus IMAP 2
osv·2019-06-03·CVSS 9.8
CVE-2019-11356 [CRITICAL] CVE-2019-11356: The CalDAV feature in httpd in Cyrus IMAP 2
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-11356 cyrus-imapd: specialy crafted HTTP PUT operation in CalDAV feature of httpd in IMAP leading to arbitrary code execution [fedora-all]
bugzilla·2019-06-06·CVSS 9.8
CVE-2019-11356 [CRITICAL] CVE-2019-11356 cyrus-imapd: specialy crafted HTTP PUT operation in CalDAV feature of httpd in IMAP leading to arbitrary code execution [fedora-all]
CVE-2019-11356 cyrus-imapd: specialy crafted HTTP PUT operation in CalDAV feature of httpd in IMAP leading to arbitrary code execution [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg
Bugzilla
CVE-2019-11356 cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
bugzilla·2019-06-06·CVSS 9.8
CVE-2019-11356 [CRITICAL] CVE-2019-11356 cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
CVE-2019-11356 cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Upstream patch:
https://github.com/cyrusimap/cyrus-imapd/commit/a5779db8163b99463e25e7c476f9cbba438b65f3
Discussion:
Created cyrus-imapd tracking bugs for this issue:
Affects: fedora-all [bug 1717829]
---
Exploitation of this flaw would need a calendar with a specially crafted property name longer than 256 characters. A HTTP PUT operation for a event on such a calendar would cause a stack-based buffer overflow of the propname stack variable. Successful
https://access.redhat.com/errata/RHSA-2019:1771https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/https://seclists.org/bugtraq/2019/Jun/9https://usn.ubuntu.com/4566-1/https://www.cyrusimap.org/imap/download/release-notes/2.5/index.htmlhttps://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.htmlhttps://www.cyrusimap.org/imap/download/release-notes/3.0/index.htmlhttps://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.htmlhttps://www.debian.org/security/2019/dsa-4458https://access.redhat.com/errata/RHSA-2019:1771https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/https://seclists.org/bugtraq/2019/Jun/9https://usn.ubuntu.com/4566-1/https://www.cyrusimap.org/imap/download/release-notes/2.5/index.htmlhttps://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.htmlhttps://www.cyrusimap.org/imap/download/release-notes/3.0/index.htmlhttps://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.htmlhttps://www.debian.org/security/2019/dsa-4458
2019-06-03
Published