Lucene search
SuseSUSE-SA:2006:025HistoryMay 05, 2006 - 2:16 p.m.
remote denial of service in cyrus-sasl-digestmd5
2006-05-0514:16:08
lists.opensuse.org
10
0.33 Low
EPSS
Percentile
96.6%
If a server or client is using DIGEST-MD5 authentication via the cyrus-sasl libraries it is possible to cause a denial of service attack against the other side (client or server) by leaving out the “realm=” header in the authentication.
Solution
There is no known workaround, please install the update packages.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| openSUSE | 9.1 | x86_64 | cyrus-sasl-digestmd5 | < 2.1.18-33.11 | cyrus-sasl-digestmd5-2.1.18-33.11.x86_64.rpm |
| openSUSE | 9.2 | i586 | cyrus-sasl-digestmd5 | < 2.1.19-7.4 | cyrus-sasl-digestmd5-2.1.19-7.4.i586.rpm |
| openSUSE | 9.3 | i586 | cyrus-sasl-digestmd5 | < 2.1.20-7.2 | cyrus-sasl-digestmd5-2.1.20-7.2.i586.rpm |
| openSUSE | 9.3 | x86_64 | cyrus-sasl-digestmd5 | < 2.1.20-7.2 | cyrus-sasl-digestmd5-2.1.20-7.2.x86_64.rpm |
| openSUSE | 9.2 | x86_64 | cyrus-sasl-digestmd5 | < 2.1.19-7.4 | cyrus-sasl-digestmd5-2.1.19-7.4.x86_64.rpm |
| openSUSE | 9.1 | i586 | cyrus-sasl-digestmd5 | < 2.1.18-33.11 | cyrus-sasl-digestmd5-2.1.18-33.11.i586.rpm |
Related
nessus
nessus
GLSA-200604-15 : xine-ui: Format string vulnerabilities
2006-04-28 00:00:00
Mandrake Linux Security Advisory : xine-ui (MDKSA-2006:085)
2006-05-13 00:00:00
debiancve
debiancve
gentoo
gentoo
xine-ui: Format string vulnerabilities
2006-04-26 00:00:00
ClamAV: Buffer overflow in Freshclam
2006-05-02 00:00:00
Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of service
2006-04-21 00:00:00
openvas
openvas
FreeBSD Ports: xine
2008-09-04 00:00:00
Gentoo Security Advisory GLSA 200604-15 (xine-ui)
2008-09-24 00:00:00
FreeBSD Ports: xine
2008-09-04 00:00:00
prion
prion
Format string
2006-04-20 10:02:00
Buffer overflow
2006-05-01 19:06:00
Design/Logic Flaw
2006-04-11 23:02:00
ubuntucve
ubuntucve
freebsd
freebsd
xine -- multiple remote string vulnerabilities
2006-04-18 00:00:00
clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability
2006-05-01 00:00:00
cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service
2006-04-11 00:00:00
cve
cve
debian
debian
[SECURITY] [DSA 1050-1] New ClamAV packages fix denial of service or arbitrary code execution
2006-05-03 15:24:49
[SECURITY] [DSA 1050-1] New ClamAV packages fix denial of service or arbitrary code execution
2006-05-03 15:24:49
[SECURITY] [DSA 1042-1] New Cyrus SASL packages fix denial of service
2006-04-25 17:35:50
cert
cert
ClamAV vulnerable to buffer overflow via malicious database mirror
2006-06-28 00:00:00
osv
osv
clamav - buffer overflow
2006-05-02 00:00:00
oraclelinux
oraclelinux
Moderate: cyrus-sasl security update
2007-09-04 00:00:00
Moderate: cyrus-sasl security and bug fix update
2007-09-04 00:00:00
centos
centos
cyrus security update
2007-09-04 21:52:33
cyrus security update
2007-09-04 21:31:32
ubuntu
ubuntu
cyrus-sasl2 vulnerability
2006-04-24 00:00:00
redhat
redhat
(RHSA-2007:0878) Moderate: cyrus-sasl security update
2007-09-04 00:00:00
(RHSA-2007:0795) Moderate: cyrus-sasl security and bug fix update
2007-09-04 00:00:00
securityvulns
securityvulns
