CVE-2011-3372

Published: Dec 24, 2011Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.

Affected (1)

Products: Cyrus: Imapd

Cyrus

1 product

Imapd

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cyrus Imapd	Up to 2.4.11

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (18)

http://cyrusimap.org/mediawiki/index.php/Latest_Updates

Source: secalert@redhat.com

http://git.cyrusimap.org/cyrus-imapd/commit/?id=77903669e04c9788460561dd0560b9c916519594

Source: secalert@redhat.com

http://secunia.com/advisories/46093

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/secunia_research/2011-68

Source: secalert@redhat.com

Vendor Advisory

http://securitytracker.com/id?1026363

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2318

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2011:149

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-1508.html

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=740822

Source: secalert@redhat.com

http://cyrusimap.org/mediawiki/index.php/Latest_Updates