DSA-563-3 cyrus-sasl - unsanitised input

Bulletin has no description...

Fedora Core 2 : cyrus-sasl-2.1.18-2.2 (2004-332)

At application startup, libsasl and libsasl2 attempt to build a list of all SASL plug-ins which are available on the system. To do so, the libraries search for and attempt to load every shared library found within the plug-in directory. This location can be set with the SASLPATH environment...

RHEL 2.1 / 3 : cyrus-sasl (RHSA-2004:546)

Updated cyrus-sasl packages that fix a setuid and setgid application vulnerability are now available. Updated 7th October 2004 Revised cryus-sasl packages have been added for Red Hat Enterprise Linux 3; the patch in the previous packages broke interaction with ldap. The cyrus-sasl package contain...

Multiple Cyrus-SASL bugs

Buffer overflow in digestmda5.c and during environment parsing. User supplied modules are loaded into suid application...

Mandrake Linux Security Advisory : cyrus-sasl (MDKSA-2004:106)

A vulnerability was discovered in the libsasl library of cyrus-sasl. libsasl honors the SASLPATH environment variable blindly, which could allow a local user to create a malicious 'library' that would get executed with the effective ID of SASL when anything calls libsasl. The provided packages ar...

[ GLSA 200410-05 ] Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities

Gentoo Linux Security Advisory GLSA 200410-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

security flaw

The 1 libsasl and 2 libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASLPATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASLPATH to point to malicious programs...

Important: Red Hat Security Advisory: cyrus-sasl security update

Updated cyrus-sasl packages that fix a setuid and setgid application vulnerability are now available. Updated 7th October 2004 Revised cryus-sasl packages have been added for Red Hat Enterprise Linux 3; the patch in the previous packages broke interaction with ldap. The cyrus-sasl package contain...

CVE-2005-0373

Buffer overflow in digestmd5.c CVS release 1.170 also referred to as digestmda5.c, as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code...

CVE-2005-0373

Buffer overflow in digestmd5.c CVS release 1.170 also referred to as digestmda5.c, as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code...

DEBIAN-CVE-2005-0373

Buffer overflow in digestmd5.c CVS release 1.170 also referred to as digestmda5.c, as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code...

CVE-2005-0373

Buffer overflow in digestmd5.c CVS release 1.170 also referred to as digestmda5.c, as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code...

GLSA-200410-05 : Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200410-05 Cyrus-SASL: Buffer overflow and SASLPATH vulnerabilities Cyrus-SASL contains a remote buffer overflow in the digestmda5.c file. Additionally, under certain conditions it is possible for a local user to exploit a...

Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities

Background Cyrus-SASL is an implementation of the Simple Authentication and Security Layer. Description Cyrus-SASL contains a remote buffer overflow in the digestmda5.c file. Additionally, under certain conditions it is possible for a local user to exploit a vulnerability in the way the SASLPATH...

Debian DSA-215-1 : cyrus-imapd - buffer overflow

Timo Sirainen discovered a buffer overflow in the Cyrus IMAP server, which could be exploited by a remote attacker prior to logging in. A malicious user could craft a request to run commands on the server under the UID and GID of the cyrus server. %NASLMINLEVEL 70300 C Tenable Network Security,...

cyrus-sasl -- dynamic library loading and set-user-ID applications

The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASLPATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application such as chsh...

Cyrus IMAP Server login Command Remote Overflow

Binary data 1085.prm...

Mandrake Linux Security Advisory : cyrus-sasl (MDKSA-2002:018)

Kari Hurtta discovered that a format bug exists in the Cyrus SASL library, which is used to provide an authentication API for mail clients and servers, as well as other services such as LDAP. The format bug was found in one of the logging functions which could be used by an attacker to obtain...

SUSE-SA:2002:048: cyrus-imapd

The remote host is missing the patch for the advisory SUSE-SA:2002:048 cyrus-imapd. The cyrus imapd contains a buffer overflow which could be exploited by remote attackers prior to logging in. Attackers could generate oversized error messages and overflow buffers inside imapd. Additionally to thi...

FreeBSD : Cyrus IMSPd multiple vulnerabilities (34)

The following package needs to be updated: cyrus-imspd %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg700d43b4a42a11d89c6d0020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...