PT-2002-2273 · Cyrus · Cyrus Sasl Library

CVE-2002-1347

·

Publicado

2002-12-11

·

Atualizado

2024-02-02

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Cyrus SASL library versions 2.1.9 and earlier
Description: The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via multiple buffer overflows. These overflows can occur due to long inputs during user name canonicalization, characters that need to be escaped during LDAP authentication using saslauthd, or an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.
Recommendations: For Cyrus SASL library versions 2.1.9 and earlier, update to a version later than 2.1.9 to resolve the issue. As a temporary workaround, consider restricting the length of user inputs during name canonicalization and limiting the characters that need to be escaped during LDAP authentication using saslauthd. Additionally, ensure proper allocation of space for the null character in the log writer to prevent off-by-one errors.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-131

Identificadores relacionados

CVE-2002-1347

Produtos afetados

Cyrus Sasl Library