Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.

A buffer overflow was discovered in cyrus-sasl's digestmd5 code. This could lead to a remote attacker executing code in the context of the service using SASL authentication. This vulnerability was fixed upstream in version 2.1.19.

The updated packages are patched to deal with this issue.

The remote host is missing the patch for the advisory SUSE-SA:2005:013 (cyrus-sasl,cyrus-sasl2).


cyrus-sasl is a library providing authentication services.

A buffer overflow in the digestmda5 code was identified that could lead to a remote attacker executing code in the context of the service using sasl authentication.

This is tracked by the Mitre CVE ID CVE-2005-0373.

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. The library honors the environment variable SASL_PATH blindly, which allows a local user to link against a malicious library to run arbitrary code with the privileges of a setuid or setgid application.

The MIT version of the Cyrus implementation of the SASL library provides bindings against MIT GSSAPI and MIT Kerberos4.

This advisory is an addition to DSA 563-1 and 563-2 which weren't able to supersede the library on sparc and arm due to a different version number for them in the stable archive. Other architectures were updated properly. Another problem was reported in connection with sendmail, though, which should be fixed with this update as well.

A vulnerability was discovered in the libsasl library of cyrus-sasl.
libsasl honors the SASL_PATH environment variable blindly, which could allow a local user to create a malicious 'library' that would get executed with the effective ID of SASL when anything calls libsasl.

The provided packages are patched to protect against this vulnerability.

The remote host is affected by the vulnerability described in GLSA-200410-05 (Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities)

    Cyrus-SASL contains a remote buffer overflow in the digestmda5.c file.
    Additionally, under certain conditions it is possible for a local user     to exploit a vulnerability in the way the SASL_PATH environment     variable is honored (CAN-2004-0884).
  Impact :

    An attacker might be able to execute arbitrary code with the Effective     ID of the application calling the Cyrus-SASL libraries.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
17332	Mandrake Linux Security Advisory : cyrus-sasl (MDKSA-2005:054)	Nessus	Mandriva Local Security Checks	high
17271	SUSE-SA:2005:013: cyrus-sasl,cyrus-sasl2	Nessus	SuSE Local Security Checks	high
15666	Debian DSA-568-1 : cyrus-sasl-mit - unsanitised input	Nessus	Debian Local Security Checks	high
15661	Debian DSA-563-3 : cyrus-sasl - unsanitised input	Nessus	Debian Local Security Checks	high
15435	Mandrake Linux Security Advisory : cyrus-sasl (MDKSA-2004:106)	Nessus	Mandriva Local Security Checks	high
15431	GLSA-200410-05 : Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-0373

critical

Tenable Plugins

high

high

high

high

high

high