Ubuntu 15.04 : cyrus-sasl2 vulnerability (USN-2755-1)

It was discovered that Cyrus SASL incorrectly handled certain invalid password salts. An attacker could use this issue to cause Cyrus SASL to crash, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security...

Gentoo Security Advisory GLSA 201309-01

Gentoo Linux Local Security Checks GLSA 201309-01 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Debian DSA-3368-1 : cyrus-sasl2 - security update

It was discovered that cyrus-sasl2, a library implementing the Simple Authentication and Security Layer, does not properly handle certain invalid password salts. A remote attacker can take advantage of this flaw to cause a denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

[SECURITY] [DSA 3368-1] cyrus-sasl2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3368-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 25, 2015 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-3368-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux AMI : cyrus-sasl (ALAS-2014-338)

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt or, when FIPS-140...

Medium: cyrus-sasl

Issue Overview: Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt o...

F5 ARX Series Cyrus SASL空指针引用漏洞

CVE ID:CVE-2013-4122 F5 ARX Series是F5公司开发的智能文件存储管理解决方案。 F5 ARX Series相关的ARX管理配置工具所使用的Cyrus SASL存在安全漏洞，允许远程攻击者利用漏洞提交特殊请求执行拒绝服务攻击。使用LDAP或者Kerberos进行用户验证的系统受此漏洞影响。 0 F5 ARX Series 6.x 目前没有详细解决方案提供： http://support.f5.com/kb/en-us/products/arx.html...

SOL14901 - SASL vulnerability CVE-2013-4122

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

CVE-2013-4122

CVE-2013-4122 affects Cyrus SASL 2.1.23, 2.1.26 and earlier. The root cause is incorrect handling of when a NULL value is returned on error by the crypt function in glibc 2.17+, enabling remote DoS via (1) invalid salt or (2) DES or (3) MD5 passwords when FIPS-140 is enabled, triggering a NULL po...

[USN-1988-1] Cyrus SASL vulnerability

========================================================================== Ubuntu Security Notice USN-1988-1 October 09, 2013 cyrus-sasl2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...

CVE-2012-4122

Cisco NX-OS Software contains a vulnerability in the CLI parser that allows an authenticated, local attacker to bypass access restrictions and create or overwrite arbitrary files via shell output redirection. Affected component: the CLI parsing logic in Cisco NX-OS. Impact: local privilege abuse ...

FreeBSD Ports: FreeBSD

The remote host is missing an update to the system as announced in the referenced advisory. VID e51d5b1a-4638-11e1-9f47-00e0815b8da8 OpenVAS Vulnerability Test $ Description: Auto generated from VID e51d5b1a-4638-11e1-9f47-00e0815b8da8 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

FreeBSD Ports: FreeBSD

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Design/Logic Flaw

kcheckpass passes a user-supplied argument to the pamstart function, often within a setuid environment, which allows local users to invoke any configured PAM stack, and possibly trigger unintended side effects, via an arbitrary valid PAM service name, a different vulnerability than CVE-2011-4122...

CVE-2011-4122

CVE-2011-4122 is a directory-traversal vulnerability in the OpenPAM library used by FreeBSD (OpenPAM

CVE-2011-4122

creationtimestamp| type| source ---|---|--- 2011-11-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36296...

CVE-2008-4122

CVE-2008-4122 affects Joomla! 1.5.8, where the session cookie is not marked as Secure in HTTPS sessions. This allows interception of the session cookie if an attacker can observe HTTP traffic, potentially enabling session hijacking. The issue is rooted in the cookie not using the Secure flag, as ...

Joomla: Session hijacking vulnerability, CVE-2008-4122

Joomla: Session hijacking vulnerability, CVE-2008-4122 References https://vulners.com/cve/CVE-2008-4122 http://int21.de/cve/CVE-2008-4122-joomla.html http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/ https://www.defcon.org/html/defcon-16/dc-16-speakers.htmlPerry Description...

CVE-2007-4122

The CVE-2007-4122 entry concerns Hitachi JP1/Cm2/Hierarchical Viewer (HV) with affected versions 06-00 through 06-71-/B. The issue is described as an unspecified vulnerability that enables remote attackers to cause a denial of service (application stop and web interface outage) via certain “unexp...