Debian DSA-563-3 : cyrus-sasl - unsanitised input

This advisory is an addition to DSA 563-1 and 563-2 which weren't able to supersede the library on sparc and arm due to a different version number for them in the stable archive. Other architectures were updated properly. Another problem was reported in connection with sendmail, though, which...

Debian DSA-568-1 : cyrus-sasl-mit - unsanitised input

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. The library honors the environment variable SASLPATH blindly, which allows a local user to...

CVE-2004-0884

The 1 libsasl and 2 libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASLPATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASLPATH to point to malicious programs...

CVE-2004-0884

CVE-2004-0884 affects the Cyrus-SASL libraries (libsasl and libsasl2) up to version 2.1.18. The vulnerability arises because these libraries trust the SASL_PATH environment variable to locate SASL plug-ins, allowing a local attacker to cause arbitrary code execution by pointing SASL_PATH to malic...

CVE-2004-0884

The 1 libsasl and 2 libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASLPATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASLPATH to point to malicious programs...

FreeBSD : cyrus-sasl -- dynamic library loading and set-user-ID applications (35)

The following package needs to be updated: cyrus-sasl %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg92268205194711d9bc4a000c41e2cdad.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...

[SECURITY] [DSA 568-1] New cyrus-sasl-mit packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 568-1 [email protected] http://www.debian.org/security/ Martin Schulze October 16th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 568-1] New cyrus-sasl-mit packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 568-1 [email protected] http://www.debian.org/security/ Martin Schulze October 16th, 2004 http://www.debian.org/security/faq -...

DSA-568-1 cyrus-sasl-mit - unsanitised input

Bulletin has no description...

[SECURITY] [DSA 563-3] New cyrus-sasl packages fix arbitrary code execution on sparc and arm

-------------------------------------------------------------------------- Debian Security Advisory DSA 563-3 [email protected] http://www.debian.org/security/ Martin Schulze October 14th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 563-3] New cyrus-sasl packages fix arbitrary code execution on sparc and arm

-------------------------------------------------------------------------- Debian Security Advisory DSA 563-3 [email protected] http://www.debian.org/security/ Martin Schulze October 14th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 563-2] New cyrus-sasl packages really fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 563-2 [email protected] http://www.debian.org/security/ Martin Schulze October 12th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 563-2] New cyrus-sasl packages really fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 563-2 [email protected] http://www.debian.org/security/ Martin Schulze October 12th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 563-1] New cyrus-sasl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 563-1 [email protected] http://www.debian.org/security/ Martin Schulze October 12th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 563-1] New cyrus-sasl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 563-1 [email protected] http://www.debian.org/security/ Martin Schulze October 12th, 2004 http://www.debian.org/security/faq -...

DSA-563-3 cyrus-sasl - unsanitised input

Bulletin has no description...

Fedora Core 2 : cyrus-sasl-2.1.18-2.2 (2004-332)

At application startup, libsasl and libsasl2 attempt to build a list of all SASL plug-ins which are available on the system. To do so, the libraries search for and attempt to load every shared library found within the plug-in directory. This location can be set with the SASLPATH environment...

Multiple Cyrus-SASL bugs

Buffer overflow in digestmda5.c and during environment parsing. User supplied modules are loaded into suid application...

[ GLSA 200410-05 ] Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities

Gentoo Linux Security Advisory GLSA 200410-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Mandrake Linux Security Advisory : cyrus-sasl (MDKSA-2004:106)

A vulnerability was discovered in the libsasl library of cyrus-sasl. libsasl honors the SASLPATH environment variable blindly, which could allow a local user to create a malicious 'library' that would get executed with the effective ID of SASL when anything calls libsasl. The provided packages ar...