PT-2002-2273 · Cyrus · Cyrus Sasl Library

Published 2002-12-11 · Updated 2024-02-02 · CVE-2002-1347

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cyrus SASL library versions 2.1.9 and earlier

Description: The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via multiple buffer overflows. These overflows can occur due to long inputs during user name canonicalization, characters that need to be escaped during LDAP authentication using saslauthd, or an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.

Recommendations: For Cyrus SASL library versions 2.1.9 and earlier, update to a version later than 2.1.9 to resolve the issue. As a temporary workaround, consider restricting the length of user inputs during name canonicalization and limiting the characters that need to be escaped during LDAP authentication using saslauthd. Additionally, ensure proper allocation of space for the null character in the log writer to prevent off-by-one errors.

Fix

Weakness Enumeration

CWE-131

Related Identifiers

CVE-2002-1347

Affected Products

Cyrus Sasl Library

References · 18

• http://marc.info/?l=bugtraq&m=103946297703402&w=2 · Patch
• http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-1347 · Vendor Advisory
• http://debian.org/security/2002/dsa-215 · Vendor Advisory
• http://archives.neohapsis.com/archives/linux/suse/2002-q4/1275.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2002-1347 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html · Vendor Advisory
• http://securityfocus.com/advisories/4826 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1347 · Security Note
• http://redhat.com/support/errata/RHSA-2002-283.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10810 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10812 · Note
• http://securityfocus.com/bid/6347 · Note
• http://securityfocus.com/bid/6349 · Note