CVE-2004-1067: Off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer...

Security readout for executives and security teams

CVE-2004-1067 is a memory corruption flaw in Cyrus IMAP Server 2.2.9 and earlier. A remote attacker may be able to trigger it through the username field and execute arbitrary code. That makes exposed legacy mail infrastructure the business concern, especially if old Cyrus packages remain internet-facing. Exposure is most likely on systems still running Cyrus IMAP Server 2.2.9 or earlier, especially public IMAP services or mail gateways that process usernames remotely. Modern, patched distributions are less likely to be affected, but the source bundle does not enumerate all downstream package states. Treat this as a high-priority legacy exposure issue if Cyrus IMAP is present. The age of the CVE reduces surprise risk, but any still-exposed affected server could represent serious compromise potential. Confirm whether the software exists in the environment before escalating broader response. Mitigation focus: Inventory Cyrus IMAP deployments and identify any version 2.2.9 or earlier.; Apply CMU Cyrus or operating-system vendor security updates for affected packages.; Prioritize internet-facing mail servers and authentication endpoints first..

Prepared

Jun 30, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.