PT-2004-1114 · Cyrus · Cyrus-Sasl

Publicado 2004-10-07 · Atualizado 2017-07-11 · CVE-2005-0373

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cyrus-SASL versions prior to 2.1.18-r1

Description The issue is related to a buffer overflow in the DIGEST-MD5 SASL plugin, which can be exploited by remote attackers to execute arbitrary code. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

Recommendations For versions prior to 2.1.18-r1, update to version 2.1.18-r1 or later to resolve the issue. As a temporary workaround, consider disabling the DIGEST-MD5 SASL plugin until a patch is available. Restrict access to the vulnerable plugin to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-09468

CVE-2005-0373

Produtos afetados

Cyrus-Sasl

Referências · 14

• http://mandriva.com/security/advisories?name=MDKSA-2005:054 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0373 · Nota de Segurança
• https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c.diff?r1=1.170&r2=1.171 · Aviso do Fabricante
• http://monkey.org/openbsd/archive/ports/0407/msg00265.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09468 · Nota de Segurança
• http://securityfocus.com/bid/11347 · Aviso do Fabricante
• http://gentoo.org/security/en/glsa/glsa-200410-05.xml · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200410-05.xml · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17642 · Nota
• https://osv.dev/vulnerability/CVE-2005-0373 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2005-0373 · Aviso do Fabricante
• https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c?rev=1.171&content-type=text/x-cvsweb-markup · Aviso do Fabricante
• http://linuxcompatible.org/print42495.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0373 · Aviso do Fabricante