Published: 27/10/2013 Updated: 08/12/2016

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Cyrus SASL 2.1.23, 2.1.26, and previous versions does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote malicious users to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cmu cyrus-sasl 2.1.22
cmu cyrus-sasl 2.1.21
cmu cyrus-sasl 2.1.24
cmu cyrus-sasl 2.1.25
cmu cyrus-sasl 1.5.28
cmu cyrus-sasl 2.1.20
cmu cyrus-sasl 2.1.19
cmu cyrus-sasl
cmu cyrus-sasl 2.1.23

Debian Bug report logs - #716835 cyrus-sasl2: CVE-2013-4122: NULL pointer dereference Package: cyrus-sasl2; Maintainer for cyrus-sasl2 is Debian Cyrus Team <team+cyrus@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 13 Jul 2013 12:33:01 UTC Severity: important Tags: patch, securi ...

Cyrus SASL could be made to crash if it processed specially crafted input ...

It was discovered that cyrus-sasl2, a library implementing the Simple Authentication and Security Layer, does not properly handle certain invalid password salts A remote attacker can take advantage of this flaw to cause a denial of service For the stable distribution (jessie), this problem has been fixed in version 2126dfsg1-13+deb8u1 For the ...

Cyrus SASL 2123, 2126, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 217 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted passw ...

CWE-189 http://www.openwall.com/lists/oss-security/2013/07/12/6 http://www.openwall.com/lists/oss-security/2013/07/15/1 http://www.openwall.com/lists/oss-security/2013/07/12/3 http://www.openwall.com/lists/oss-security/2013/07/13/1 http://security.gentoo.org/glsa/glsa-201309-01.xml https://www.linuxquestions.org/questions/slackware-14/%5Bslackware-current%5D-glibc-2-17-shadow-and-other-penumbrae-4175461061/http://git.cyrusimap.org/cyrus-sasl/commit/?id=dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d http://www.ubuntu.com/usn/USN-2755-1 http://www.debian.org/security/2015/dsa-3368 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=716835 https://nvd.nist.gov https://usn.ubuntu.com/1988-1/https://access.redhat.com/security/cve/cve-2013-4122

CVE-2013-4122

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect