PT-2009-1022 · Cmu+1 · Cyrus-Sasl+2

James Ralston · Published 2009-05-15 · Updated 2017-09-29 · CVE-2009-0688

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cyrus-sasl versions prior to 2.1.23 sasl2-bin (affected versions not specified)

Description The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely, potentially leading to the execution of arbitrary code or a denial of service. The vulnerability is related to multiple buffer overflows in the CMU Cyrus SASL library, specifically in the sasl encode64 function in lib/saslutil.c, which can be triggered by input strings.

Recommendations For cyrus-sasl versions prior to 2.1.23, update to version 2.1.23 or later to resolve the issue. For sasl2-bin, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-03038

BDU:2015-09383

CVE-2009-0688

DSA-1807-1

DTSA-200-1

DTSA-201-1

OPENSUSE-SU-2024:10403-1

RHSA-2009:1116

RHSA-2009_1116

Affected Products

Red Hat

Cyrus-Sasl

Sasl2-Bin

References · 49

• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-0688 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200907-09.xml · Vendor Advisory
• http://debian.org/security/2009/dsa-1807 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021699.1-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0688 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259148-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020755.1-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-273910-1 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.448834 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-264248-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03038 · Security Note
• http://ubuntu.com/usn/usn-790-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-0688 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html · Vendor Advisory