Cyrus SASL vulnerability

2009-06-2400:00:00

ubuntu.com

6.2 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.407 Medium

EPSS

Percentile

97.3%

JSON

Releases

Ubuntu 9.04
Ubuntu 8.10
Ubuntu 8.04
Ubuntu 6.06

Packages

cyrus-sasl2 -

Details

James Ralston discovered that the Cyrus SASL base64 encoding function
could be used unsafely. If a remote attacker sent a specially crafted
request to a service that used SASL, it could lead to a loss of privacy,
or crash the application, resulting in a denial of service.

OSVersionArchitecturePackageVersionFilename
Ubuntu9.04noarchlibsasl2-2< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu9.04noarchcyrus-sasl2-dbg< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu9.04noarchlibsasl2-dev< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu9.04noarchlibsasl2-modules< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu9.04noarchlibsasl2-modules-gssapi-mit< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu9.04noarchlibsasl2-modules-ldap< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu9.04noarchlibsasl2-modules-otp< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu9.04noarchlibsasl2-modules-sql< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu9.04noarchsasl2-bin< 2.1.22.dfsg1-23ubuntu3.1UNKNOWN
Ubuntu8.10noarchlibsasl2-2< 2.1.22.dfsg1-21ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	9.04	noarch	libsasl2-2	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	9.04	noarch	cyrus-sasl2-dbg	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	9.04	noarch	libsasl2-dev	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	9.04	noarch	libsasl2-modules	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	9.04	noarch	libsasl2-modules-gssapi-mit	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	9.04	noarch	libsasl2-modules-ldap	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	9.04	noarch	libsasl2-modules-otp	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	9.04	noarch	libsasl2-modules-sql	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	9.04	noarch	sasl2-bin	< 2.1.22.dfsg1-23ubuntu3.1	UNKNOWN
Ubuntu	8.10	noarch	libsasl2-2	< 2.1.22.dfsg1-21ubuntu2.1	UNKNOWN