CVE-2009-0688

2009-05-1500:00:00

ubuntu.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.407

Percentile

97.3%

JSON

Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might
allow remote attackers to execute arbitrary code or cause a denial of
service (application crash) via strings that are used as input to the
sasl_encode64 function in lib/saslutil.c.

Bugs

Notes

Author	Note
jdstrand	applying upstream patch could break existing applications
mdeslaur	since the change breaks ABI, redhat updated applications that used cyrus-sasl2 improperly instead. They have released a cyrus-imapd update. See redhat bug for more info. sendmail: https://bugzilla.redhat.com/show_bug.cgi?id=504186
kees	cyrus-imapd-2.2: https://bugzilla.redhat.com/show_bug.cgi?id=504207

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchcyrus-sasl2< 2.1.19.dfsg1-0.1ubuntu3.1UNKNOWN
ubuntu8.04noarchcyrus-sasl2< 2.1.22.dfsg1-18ubuntu2.1UNKNOWN
ubuntu8.10noarchcyrus-sasl2< 2.1.22.dfsg1-21ubuntu2.1UNKNOWN
ubuntu9.04noarchcyrus-sasl2< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	cyrus-sasl2	< 2.1.19.dfsg1-0.1ubuntu3.1	UNKNOWN
ubuntu	8.04	noarch	cyrus-sasl2	< 2.1.22.dfsg1-18ubuntu2.1	UNKNOWN
ubuntu	8.10	noarch	cyrus-sasl2	< 2.1.22.dfsg1-21ubuntu2.1	UNKNOWN
ubuntu	9.04	noarch	cyrus-sasl2	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN