CVE-2019-11356

Vulnerability

The CalDAV feature in the httpd component of Cyrus IMAP versions 2.5.x through 2.5.12 and 3.0.x through 3.0.9 contains a buffer overrun vulnerability. A remote attacker can trigger this issue by sending a crafted HTTP PUT operation for an event that includes a long iCalendar property name. The affected versions are explicitly named in the advisory [1][2].

Exploitation

An attacker must have network access to the Cyrus IMAP server and the ability to send HTTP PUT requests to the CalDAV endpoint. No prior authentication is required, as the vulnerability can be triggered during the processing of the iCalendar property name before any access controls are applied. The attacker crafts a PUT request containing an excessively long iCalendar property name, which overruns a fixed-size buffer in the httpd process.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the server. This leads to a full compromise of the Cyrus IMAP service, including potential disclosure or modification of all mail and calendar data stored on the server, and the ability to pivot to other systems in the network. The impact is rated as critical based on the CVSS score.

Mitigation

The vulnerability is fixed in Cyrus IMAP version 3.0.10 [2]. Users of the affected 2.5.x series should upgrade to version 2.5.13 or later [3]. Distributions such as Red Hat Enterprise Linux 8 have released updated packages (cyrus-imapd-3.0.7-15.el8_0.1) as part of RHSA-2019:1771 [1]. No workaround is available; upgrading to a patched version is the only recommended mitigation.