1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200410-05 / Cyrus-SASL |
| Release Date | October 07, 2004 |
| Latest Revision | May 22, 2006: 02 |
| Impact | high |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| dev-libs/cyrus-sasl | <= 2.1.18-r1 | >= 2.1.18-r2 | All supported architectures |
Related bugreports: #56016
Cyrus-SASL contains two vulnerabilities that might allow an attacker to completely compromise the vulnerable system.
Cyrus-SASL is an implementation of the Simple Authentication and Security Layer.
Cyrus-SASL contains a remote buffer overflow in the digestmda5.c file. Additionally, under certain conditions it is possible for a local user to exploit a vulnerability in the way the SASL_PATH environment variable is honored (CAN-2004-0884).
An attacker might be able to execute arbitrary code with the Effective ID of the application calling the Cyrus-SASL libraries.
There is no known workaround at this time.
All Cyrus-SASL users should upgrade to the latest stable version:
Code Listing 3.1: Resolution |
# emerge sync # emerge -pv ">=dev-libs/cyrus-sasl-2.1.18-r2" # emerge ">=dev-libs/cyrus-sasl-2.1.18-r2" |