FreeBSD : cyrus-sasl -- dynamic library loading and set-user-ID applications (92268205-1947-11d9-bc4a-000c41e2cdad)

The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASLPATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application such as chsh...

cyrus-sasl -- buffer overflow vulnerability

US-CERT reports: The saslencode64 function converts a string into base64. The Cyrus SASL library contains buffer overflows that occur because of unsafe use of the saslencode64 function...

Evolution Data Server ntlm_challenge()内存内容泄露漏洞

BUGTRAQ ID: 34109 CVECAN ID: CVE-2009-0582 Evolution Data Server为地址簿、日历事件等常见的桌面信息提供单一的服务器。 Evolution Data Server所捆绑的Camel库没有正确地处理NTLM SASL报文。在camel/camel-sasl-ntlm.c的ntlmchallenge函数中，没有对从type 2拷贝到type 3报文（客户端对服务器挑战的响应）的域字符串长度验证从服务器所接收到的剩余数据： 127 ntlmsetstring ret, NTLMRESPONSEDOMAINOFFSET, 128...

evolution-data-server: insufficient checking of NTLM authentication challenge packets

The ntlmchallenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server aka evolution-data-server 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount o...

CVE-2009-0582

The ntlmchallenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server aka evolution-data-server 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount o...

CVE-2009-0582

The ntlmchallenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server aka evolution-data-server 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount o...

CVE-2009-0582

CVE-2009-0582 concerns Evolution Data Server’s Evolution/evolution-data-server NTLM authentication. The ntlm_challenge function in Camel’s NTLM SASL implementation does not validate that the length field in an NTLM type 2 challenge is consistent with the packet data, allowing a remote server to c...

[SECURITY] Fedora 8 Update: postfix-2.5.5-1.fc8

Postfix is a Mail Transport Agent MTA, supporting LDAP, SMTP AUTH SASL, TLS...

Gentoo Security Advisory GLSA 200604-09 (cyrus-sasl)

The remote host is missing updates announced in advisory GLSA 200604-09. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200604-09 (cyrus-sasl)

The remote host is missing updates announced in advisory GLSA 200604-09. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200410-05 (Cyrus-SASL)

The remote host is missing updates announced in advisory GLSA 200410-05. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200410-05 (Cyrus-SASL)

The remote host is missing updates announced in advisory GLSA 200410-05. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Moderate: Red Hat Security Advisory: redhat-ds-base security and bug fix update

Updated redhat-ds-base packages are now available that fix security issues and various bugs for Red Hat Enterprise IPA. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Red Hat Directory Server is an LDAPv3-compliant directory server. Multiple...

FreeBSD Ports: cyrus-sasl

The remote host is missing an update to the system as announced in the referenced advisory. VID 408f6ebf-d152-11da-962f-000b972eb521 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: openldap-server, openldap-sasl-server

The remote host is missing an update to the system as announced in the referenced advisory. VID ae7124ff-547c-11db-8f1a-000a48049292 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: jabberd

The remote host is missing an update to the system as announced in the referenced advisory. VID f4af098d-d921-11da-ad4a-00123ffe8333 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: openldap-server, openldap-sasl-server

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: jabberd

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: cyrus-sasl

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: cyrus-sasl

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...