PT-2004-1007 · Cyrus · Cyrus-Sasl

Josh Bressers · Published 2004-10-21 · Updated 2017-10-11 · CVE-2004-0884

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cyrus-SASL versions 2.1.18 and earlier

Description The issue allows local users to execute arbitrary code by modifying the SASL PATH environment variable to point to malicious programs, potentially leading to disruption of confidentiality, integrity, and availability of protected information. This is due to the libsasl and libsasl2 libraries trusting the SASL PATH environment variable to find all available SASL plug-ins.

Recommendations For Cyrus-SASL versions 2.1.18 and earlier, consider restricting access to the SASL PATH environment variable to prevent modification by local users until a patch is available. As a temporary workaround, avoid using the SASL PATH variable in sensitive operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-01744

CVE-2004-0884

DSA-563-3

DSA-568-1

RHSA-2004:546

Affected Products

Cyrus-Sasl

References · 21

• http://mandriva.com/security/advisories?name=MDKSA-2004:106 · Vendor Advisory
• http://trustix.net/errata/2004/0053 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0884 · Security Note
• http://securityfocus.com/bid/11347 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200410-05.xml · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2004-546.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0884 · Vendor Advisory
• http://debian.org/security/2004/dsa-568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0884 · Security Note
• https://osv.dev/vulnerability/CVE-2004-0884 · Vendor Advisory
• http://debian.org/security/2004/dsa-563 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0884 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01744 · Security Note
• https://bugzilla.fedora.us/show_bug.cgi?id=2137 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html · Vendor Advisory