CVE-2011-3481 | Vulnerability Database | Aqua Security

The index_get_ids function in index.c in imapd in Cyrus IMAP Server before 2.4.11, when server-side threading is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted References header in an e-mail message.

Affected Software

Name	Vendor	Start Version	End Version
Cyrus_imap_server	Cmu	*	2.4.10 (including)
Cyrus_imap_server	Cmu	2.0.17 (including)	2.0.17 (including)
Cyrus_imap_server	Cmu	2.1.16 (including)	2.1.16 (including)
Cyrus_imap_server	Cmu	2.1.17 (including)	2.1.17 (including)
Cyrus_imap_server	Cmu	2.1.18 (including)	2.1.18 (including)
Cyrus_imap_server	Cmu	2.2.8 (including)	2.2.8 (including)
Cyrus_imap_server	Cmu	2.2.9 (including)	2.2.9 (including)
Cyrus_imap_server	Cmu	2.2.10 (including)	2.2.10 (including)
Cyrus_imap_server	Cmu	2.2.11 (including)	2.2.11 (including)
Cyrus_imap_server	Cmu	2.2.12 (including)	2.2.12 (including)
Cyrus_imap_server	Cmu	2.2.13 (including)	2.2.13 (including)
Cyrus_imap_server	Cmu	2.2.13p1 (including)	2.2.13p1 (including)
Cyrus_imap_server	Cmu	2.3.0 (including)	2.3.0 (including)
Cyrus_imap_server	Cmu	2.3.1 (including)	2.3.1 (including)
Cyrus_imap_server	Cmu	2.3.2 (including)	2.3.2 (including)
Cyrus_imap_server	Cmu	2.3.3 (including)	2.3.3 (including)
Cyrus_imap_server	Cmu	2.3.4 (including)	2.3.4 (including)
Cyrus_imap_server	Cmu	2.3.5 (including)	2.3.5 (including)
Cyrus_imap_server	Cmu	2.3.6 (including)	2.3.6 (including)
Cyrus_imap_server	Cmu	2.3.7 (including)	2.3.7 (including)
Cyrus_imap_server	Cmu	2.3.8 (including)	2.3.8 (including)
Cyrus_imap_server	Cmu	2.3.9 (including)	2.3.9 (including)
Cyrus_imap_server	Cmu	2.3.10 (including)	2.3.10 (including)
Cyrus_imap_server	Cmu	2.3.11 (including)	2.3.11 (including)
Cyrus_imap_server	Cmu	2.3.12 (including)	2.3.12 (including)
Cyrus_imap_server	Cmu	2.3.13 (including)	2.3.13 (including)
Cyrus_imap_server	Cmu	2.3.14 (including)	2.3.14 (including)
Cyrus_imap_server	Cmu	2.3.15 (including)	2.3.15 (including)
Cyrus_imap_server	Cmu	2.3.16 (including)	2.3.16 (including)
Cyrus_imap_server	Cmu	2.3.17 (including)	2.3.17 (including)
Cyrus_imap_server	Cmu	2.4.0 (including)	2.4.0 (including)
Cyrus_imap_server	Cmu	2.4.1 (including)	2.4.1 (including)
Cyrus_imap_server	Cmu	2.4.2 (including)	2.4.2 (including)
Cyrus_imap_server	Cmu	2.4.3 (including)	2.4.3 (including)
Cyrus_imap_server	Cmu	2.4.4 (including)	2.4.4 (including)
Cyrus_imap_server	Cmu	2.4.5 (including)	2.4.5 (including)
Cyrus_imap_server	Cmu	2.4.6 (including)	2.4.6 (including)
Cyrus_imap_server	Cmu	2.4.7 (including)	2.4.7 (including)
Cyrus_imap_server	Cmu	2.4.8 (including)	2.4.8 (including)
Cyrus_imap_server	Cmu	2.4.9 (including)	2.4.9 (including)
Red Hat Enterprise Linux 4	RedHat	cyrus-imapd-0:2.2.12-17.el4	*
Red Hat Enterprise Linux 5	RedHat	cyrus-imapd-0:2.3.7-12.el5_7.2	*
Red Hat Enterprise Linux 6	RedHat	cyrus-imapd-0:2.3.16-6.el6_1.4	*
Cyrus-imapd-2.2	Ubuntu	hardy	*
Cyrus-imapd-2.2	Ubuntu	lucid	*
Cyrus-imapd-2.2	Ubuntu	maverick	*
Cyrus-imapd-2.2	Ubuntu	natty	*
Cyrus-imapd-2.2	Ubuntu	oneiric	*
Cyrus-imapd-2.4	Ubuntu	oneiric	*
Cyrus-imapd-2.4	Ubuntu	quantal	*
Cyrus-imapd-2.4	Ubuntu	raring	*
Cyrus-imapd-2.4	Ubuntu	saucy	*
Cyrus-imapd-2.4	Ubuntu	upstream	*
Kolab-cyrus-imapd	Ubuntu	hardy	*
Kolab-cyrus-imapd	Ubuntu	lucid	*
Kolab-cyrus-imapd	Ubuntu	maverick	*
Kolab-cyrus-imapd	Ubuntu	natty	*
Kolab-cyrus-imapd	Ubuntu	oneiric	*
Kolab-cyrus-imapd	Ubuntu	precise	*
Kolab-cyrus-imapd	Ubuntu	quantal	*
Kolab-cyrus-imapd	Ubuntu	raring	*
Kolab-cyrus-imapd	Ubuntu	saucy	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2011-3481
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html