7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.0005 Low
EPSS
Percentile
13.1%
The cyrus-sasl package contains the Cyrus implementation of SASL. SASL is
the Simple Authentication and Security Layer, a method for adding
authentication support to connection-based protocols.
At application startup, libsasl and libsasl2 attempts to build a list
of all available SASL plug-ins which are available on the system. To do
so, the libraries search for and attempt to load every shared library found
within the plug-in directory. This location can be set with the SASL_PATH
environment variable.
In situations where an untrusted local user can affect the environment of a
privileged process, this behavior could be exploited to run arbitrary code
with the privileges of a setuid or setgid application. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0884 to this issue.
Users of cyrus-sasl should upgrade to these updated packages, which contain
backported patches and are not vulnerable to this issue.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | any | i386 | cyrus-sasl-md5 | < 2.1.15-10 | cyrus-sasl-md5-2.1.15-10.i386.rpm |
RedHat | any | s390 | cyrus-sasl-plain | < 2.1.15-10 | cyrus-sasl-plain-2.1.15-10.s390.rpm |
RedHat | any | ppc | cyrus-sasl-md5 | < 2.1.15-10 | cyrus-sasl-md5-2.1.15-10.ppc.rpm |
RedHat | any | s390x | cyrus-sasl-md5 | < 2.1.15-10 | cyrus-sasl-md5-2.1.15-10.s390x.rpm |
RedHat | any | i386 | cyrus-sasl | < 2.1.15-10 | cyrus-sasl-2.1.15-10.i386.rpm |
RedHat | any | ppc | cyrus-sasl | < 2.1.15-10 | cyrus-sasl-2.1.15-10.ppc.rpm |
RedHat | any | ia64 | cyrus-sasl-md5 | < 1.5.24-26 | cyrus-sasl-md5-1.5.24-26.ia64.rpm |
RedHat | any | i386 | cyrus-sasl-plain | < 1.5.24-26 | cyrus-sasl-plain-1.5.24-26.i386.rpm |
RedHat | any | ppc | cyrus-sasl-devel | < 2.1.15-10 | cyrus-sasl-devel-2.1.15-10.ppc.rpm |
RedHat | any | ia64 | cyrus-sasl-devel | < 1.5.24-26 | cyrus-sasl-devel-1.5.24-26.ia64.rpm |