PT-2004-1114 · Cyrus · Cyrus-Sasl

Published 2004-10-07 · Updated 2017-07-11 · CVE-2005-0373

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cyrus-SASL versions prior to 2.1.18-r1

Description The issue is related to a buffer overflow in the DIGEST-MD5 SASL plugin, which can be exploited by remote attackers to execute arbitrary code. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

Recommendations For versions prior to 2.1.18-r1, update to version 2.1.18-r1 or later to resolve the issue. As a temporary workaround, consider disabling the DIGEST-MD5 SASL plugin until a patch is available. Restrict access to the vulnerable plugin to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09468

CVE-2005-0373

Affected Products

Cyrus-Sasl

References · 14

• http://mandriva.com/security/advisories?name=MDKSA-2005:054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0373 · Security Note
• https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c.diff?r1=1.170&r2=1.171 · Vendor Advisory
• http://monkey.org/openbsd/archive/ports/0407/msg00265.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09468 · Security Note
• http://securityfocus.com/bid/11347 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200410-05.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-0373 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-0373 · Vendor Advisory
• https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c?rev=1.171&content-type=text/x-cvsweb-markup · Vendor Advisory
• http://linuxcompatible.org/print42495.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0373 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200410-05.xml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17642 · Note