Vulnerabilities > CVE-2015-8077 - Numeric Errors vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_D62EC98E97D811E58C0E080027B00C2E.NASL description Cyrus IMAP 2.5.7 Release Note states : CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks last seen 2020-06-01 modified 2020-06-02 plugin id 87165 published 2015-12-02 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/87165 title FreeBSD : cyrus-imapd -- integer overflow in the start_octet addition (d62ec98e-97d8-11e5-8c0e-080027b00c2e) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2019 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(87165); script_version("2.4"); script_cvs_date("Date: 2019/10/11 10:17:50"); script_cve_id("CVE-2015-8077", "CVE-2015-8078"); script_name(english:"FreeBSD : cyrus-imapd -- integer overflow in the start_octet addition (d62ec98e-97d8-11e5-8c0e-080027b00c2e)"); script_summary(english:"Checks for updated packages in pkg_info output"); script_set_attribute( attribute:"synopsis", value: "The remote FreeBSD host is missing one or more security-related updates." ); script_set_attribute( attribute:"description", value: "Cyrus IMAP 2.5.7 Release Note states : CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks" ); # http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?2eb0addd" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2015-8078" ); # http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?2365e5e3" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2015-8077" ); # https://vuxml.freebsd.org/freebsd/d62ec98e-97d8-11e5-8c0e-080027b00c2e.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?eee4fb34" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:cyrus-imapd24"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:cyrus-imapd25"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/11/04"); script_set_attribute(attribute:"patch_publication_date", value:"2015/12/01"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/02"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"cyrus-imapd25>=2.5.0<2.5.7")) flag++; if (pkg_test(save_report:TRUE, pkg:"cyrus-imapd24>=2.4.0<2.4.18_2")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family SuSE Local Security Checks NASL id SUSE_SU-2016-1457-1.NASL description - Previous versions of cyrus-imapd would not allow its users to disable old protocols like SSLv1 and SSLv2 that are unsafe due to various known attacks like BEAST and POODLE. https://bugzilla.cyrusimap.org/show_bug.cgi?id=3867 remedies this issue by adding the configuration option last seen 2020-06-01 modified 2020-06-02 plugin id 91650 published 2016-06-17 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/91650 title SUSE SLES12 Security Update : cyrus-imapd (SUSE-SU-2016:1457-1) (POODLE) NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-859.NASL description This update for cyrus-imapd fixes the following issues : - Added cyrus-imapd-2.3.19-cve-2015-8077.patch: boo#954200, CVE-2015-8077: Integer overflow in range checks last seen 2020-06-05 modified 2015-12-17 plugin id 87437 published 2015-12-17 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/87437 title openSUSE Security Update : cyrus-imapd (openSUSE-2015-859) NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-828.NASL description The cyrus-imapd package was updated to fix two security issues. - CVE-2015-8077: Integer overflow in range checks (bnc#954200) - CVE-2015-8078: Integer overflow in index_urlfetch (bnc#954201) last seen 2020-06-05 modified 2015-11-30 plugin id 87089 published 2015-11-30 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/87089 title openSUSE Security Update : cyrus-imapd (openSUSE-2015-828)
References
- http://www.openwall.com/lists/oss-security/2015/09/30/3
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.html
- https://cyrus.foundation/cyrus-imapd/commit/?id=745e161c834f1eb6d62fc14477f51dae799e1e08
- https://lists.andrew.cmu.edu/pipermail/cyrus-devel/2015-October/003534.html
- http://www.openwall.com/lists/oss-security/2015/11/04/3
- https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00015.html
- http://www.securitytracker.com/id/1034282