Moderate: Red Hat Security Advisory: cyrus-sasl security and bug fix update

An updated cyrus-sasl package that addresses a security issue and fixes various other bugs is now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The cyrus-sasl package contains the Cyrus implementation...

cyrus-sasl digest-md5 DoS

digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer SASL library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of service segmentation fault via malformed inputs in DIGEST-MD5 negotiation...

Moderate: cyrus-sasl security update

2.1.15-15 - Changed spec file to include the mech patch all the time. - Added patch to prevent printing null realm - Applied existing mech for 1.5 to 2.1 Related: rhbz189814 2.1.15-14 - temporarily back out the fixes for 157012, 190113 2.1.15-13 - add unapplied patches which make the DIGEST-MD5...

Moderate: cyrus-sasl security and bug fix update

2.1.19-14 - Related: bz250732 Fixed a conflict with an earlier test patch 2.1.19-13 - Related: bz250732 Fixed uninitialized stack variable causing segfault 2.1.19-12 - Resolves: bz250732 sasl-sample-server crashes with null realm 2.1.19-11 - Resolves: bz243910 krb5-libs are not thread-safe -...

Fedora Core 4 : cyrus-sasl-2.1.20-6 (2006-515)

This update incorporates a fix for a bug which would allow a client which attempted DIGEST-MD5 authentication with a server to cause the DIGEST-MD5 plugin on the server to crash. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

Apple Mac OS X多个命令执行及拒绝服务漏洞

Apple Mac OS X是苹果家族机器所使用的操作系统。 Apple Mac OS X的多个组件存在漏洞，攻击者可能利用这些漏洞导致执行命令或拒绝服务。 1. CFNetwork的客户端（比如Safari）允许建立匿名的SSL连接，远程非认证的SSL站可以利用这个漏洞使之看起来是认证过的。 2. Flash播放器存在漏洞，远程攻击者可能利用此漏洞执行任意命令。 3. ImageIO在处理畸形的JPEG2000图像时存在缓冲区溢出漏洞，攻击者可能利用此漏洞执行任意指令。 4. Kernel Mach中存在漏洞可以使恶意用户以高权限执行任意命令。 5...

Debian DSA-1042-1 : cyrus-sasl2 - programming error

The Mu Security research team discovered a denial of service condition in the Simple Authentication and Security Layer authentication library SASL during DIGEST-MD5 negotiation. This potentially affects multiple products that use SASL DIGEST-MD5 authentication including OpenLDAP, Sendmail, Postfi...

Cyrus IMAPD 2.3.2 (pop3d) Remote Buffer Overflow Exploit (3)

Exploit for linux platform in category remote exploits ============================================================ Cyrus IMAPD 2.3.2 pop3d Remote Buffer Overflow Exploit 3 ============================================================ !/usr/bin/perl Creator: K-sPecial xzziroz.net of .aware...

Cyrus IMAPD 2.3.2 - pop3d Remote Buffer Overflow (3)

Cyrus IMAPD 2.3.2 - pop3d Remote Buffer Overflow 3 !/usr/bin/perl Creator: K-sPecial xzziroz.net of .aware awarenetwork.org Name: bid-18056.pl Date: 08/12/2006 Description: this is yet another exploit for the cyrus pop3d buffer overflow. I tried both public exploits and not either of them worked...

Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (3)

!/usr/bin/perl Creator: K-sPecial xzziroz.net of .aware awarenetwork.org Name: bid-18056.pl Date: 08/12/2006 Description: this is yet another exploit for the cyrus pop3d buffer overflow. I tried both public exploits and not either of them worked not that they don't but coding my own is generaly...

Cyrus IMAPD 2.3.2 (pop3d) Remote Buffer Overflow Exploit (2)

Exploit for multiple platform in category remote exploits ============================================================ Cyrus IMAPD 2.3.2 pop3d Remote Buffer Overflow Exploit 2 ============================================================ !/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit...

Cyrus IMAPD 2.3.2 (pop3d) Remote Buffer Overflow Exploit (2)

No description provided by source. !/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit 05/23/2006 This exploit takes advantage of a stack based overflow. Once the stack corruption has occured it is possible to overwrite a pointer which is later used for a memcpy this gives us a write anything...

Cyrus IMAPD 2.3.2 - pop3d Remote Buffer Overflow (2)

Cyrus IMAPD 2.3.2 - pop3d Remote Buffer Overflow 2 !/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit 05/23/2006 This exploit takes advantage of a stack based overflow. Once the stack corruption has occured it is possible to overwrite a pointer which is later used for a memcpy this gives us a...

Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (2)

!/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit 05/23/2006 This exploit takes advantage of a stack based overflow. Once the stack corruption has occured it is possible to overwrite a pointer which is later used for a memcpy this gives us a write anything anywhere condition similar to a forma...

CentOS 4 : cyrus-imapd (CESA-2005:408)

Updated cyrus-imapd packages that fix several buffer overflow security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The cyrus-imapd package contains the core of the Cyrus IMAP server. Several buffer overflow bugs we...

Cyrus IMAP pop3d popsubfolders buffer overflow

Added: 06/12/2006 CVE: CVE-2006-2502 BID: 18056 OSVDB: 25853 Background Cyrus IMAP is an open-source IMAP, POP3, and KPOP server. The popsubfolders configuration option allows POP3 users to access subfolders by specifying the subfolder name when logging in. Problem When the popsubfolders...

Cyrus IMAP pop3d popsubfolders buffer overflow

Added: 06/12/2006 CVE: CVE-2006-2502 BID: 18056 OSVDB: 25853 Background Cyrus IMAP is an open-source IMAP, POP3, and KPOP server. The popsubfolders configuration option allows POP3 users to access subfolders by specifying the subfolder name when logging in. Problem When the popsubfolders...

Cyrus IMAP pop3d popsubfolders buffer overflow

Added: 06/12/2006 CVE: CVE-2006-2502 BID: 18056 OSVDB: 25853 Background Cyrus IMAP is an open-source IMAP, POP3, and KPOP server. The popsubfolders configuration option allows POP3 users to access subfolders by specifying the subfolder name when logging in. Problem When the popsubfolders...

Cyrus IMAP pop3d popsubfolders buffer overflow

Added: 06/12/2006 CVE: CVE-2006-2502 BID: 18056 OSVDB: 25853 Background Cyrus IMAP is an open-source IMAP, POP3, and KPOP server. The popsubfolders configuration option allows POP3 users to access subfolders by specifying the subfolder name when logging in. Problem When the popsubfolders...

Preemptive Protection against Cyrus IMAP Server USER Command Code Execution

Cyrus IMAP is an IMAP server developed and maintained by Carnegie Mellon University. A vulnerability has been identified in Cyrus IMAP in the processing of overly long USER commands. The vulnerability could be exploited by remote attackers to crash a vulnerable application or execute arbitrary...