Published: 27/01/2005 Updated: 11/10/2017

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and previous versions trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cyrus sasl 2.1.10
cyrus sasl 2.1.11
cyrus sasl 2.1.18
cyrus sasl 2.1.18_r1
cyrus sasl 2.1.9
cyrus sasl 2.1.12
cyrus sasl 2.1.13
conectiva linux 10.0
conectiva linux 9.0
cyrus sasl 1.5.24
cyrus sasl 2.1.14
cyrus sasl 2.1.15
cyrus sasl 1.5.27
cyrus sasl 1.5.28
cyrus sasl 2.1.16
cyrus sasl 2.1.17

Synopsis cyrus-sasl security update Type/Severity Security Advisory: Important Topic Updated cyrus-sasl packages that fix a setuid and setgid applicationvulnerability are now available[Updated 7th October 2004]Revised cryus-sasl packages have been added for Red Hat Enterprise Linux 3;the patch in the previ ...

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols The library honors the environment variable SASL_PATH blindly, which allows a local user to link against a malicious library to run arbitrary cod ...

NVD-CWE-Other http://www.debian.org/security/2004/dsa-563 http://www.securityfocus.com/bid/11347 http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html http://www.debian.org/security/2004/dsa-568 https://bugzilla.fedora.us/show_bug.cgi?id=2137 http://www.gentoo.org/security/en/glsa/glsa-200410-05.xml http://rhn.redhat.com/errata/RHSA-2004-546.html http://www.trustix.net/errata/2004/0053/http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=134657 http://www.ciac.org/ciac/bulletins/p-003.shtml http://www.mandriva.com/security/advisories?name=MDKSA-2004:106 http://marc.info/?l=bugtraq&m=110693126007214&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/17643 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11678 https://access.redhat.com/errata/RHSA-2004:546 https://nvd.nist.gov https://www.debian.org/security/./dsa-568

CVE-2004-0884

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect