FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

cyrus-imapd -- unbounded memory allocation

Affected packages
cyrus-imapd38 < 3.8.2_1
cyrus-imapd36 < 3.6.4_1
cyrus-imapd34 < 3.4.7_1
0 < cyrus-imapd25
0 < cyrus-imapd30
0 < cyrus-imapd32

Details

VuXML ID 14908bda-232b-11ef-b621-00155d645102
Discovery 2024-04-30
Entry 2024-06-05

Cyrus IMAP 3.8.3 Release Notes states:

Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.

The IMAP protocol allows for command arguments to be LITERALs of negotiated length, and for these the server allocates memory to receive the content before instructing the client to proceed. The allocated memory is released when the whole command has been received and processed.

The IMAP protocol has a number commands that specify an unlimited number of arguments, for example SEARCH. Each of these arguments can be a LITERAL, for which memory will be allocated and not released until the entire command has been received and processed. This can run a server out of memory, with varying consequences depending on the server's OOM policy.

References

CVE Name CVE-2024-34055
URL https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055