Overview
The Cyrus SASL library contains a buffer overflow vulnerability that could allow an attacker to execute code or cause a vulnerable program to crash.
Description
SASL (Simple Authentication and Security Layer) is a method for adding authentication support to various protocols. SASL is commonly used by mail servers to request authentication from clients and by clients to authenticate to servers. The sasl_encode64() function converts a string into base64. The Cyrus SASL library contains buffer overflows that occur because of unsafe use of the sasl_encode64() function. |
Impact
A remote attacker might be able to execute code, or cause any programs relying on SASL to crash or be unavailable. |
Solution
Upgrade |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to James Ralston for reporting this issue and providing technical information.
This document was written by Ryan Giobbi.
Other Information
| CVE IDs: | CVE-2009-0688 |
| Severity Metric: | 4.04 |
| Date Public: | 2009-04-08 |
| Date First Published: | 2009-05-14 |
| Date Last Updated: | 2009-08-26 13:19 UTC |
| Document Revision: | 24 |