Cyrus' Sieve implementation has been found to contain multiple buffer overflow vulnerabilities. These overflows allow remote attackers to cause the program to execute arbitrary code.
Credit:
The information has been provided by Timo Sirainen.
Vulnerable systems:
* Versions up to libSieve 2.1.2 and Cyrus IMAP 2.1.10 are affected.
Cyrus' Sieve implementation contains a couple of classic string based buffer overflows in script parsing code. Anyone who can execute Sieve scripts can exploit these bugs.
Note that with Cyrus IMAP server exploiting this gives you the privileges of Cyrus user, capable of reading all users mails.
Problem comes when giving the script a >100 chars long corrupted header name, >100 chars long IMAP flag or a script that contains lots of errors to overflow the 500 char limit in error message.
Fix:
Apply the included patch. Note that this changes only the yacc files, you still need to generate .c files from them. libSieve 2.1.3 will hopefully also contain some more hardening against potential buffer overflows.
