Cyrus SASL SASL_PATH Environment Variable May Let Local Users Gain Elevated Privileges and Buffer Overflow May Permit Remote Code Execution
|
|
SecurityTracker Alert ID: 1011568 |
|
SecurityTracker URL: http://securitytracker.com/id/1011568
|
|
CVE Reference:
CAN-2004-0884, CAN-2005-0373
(Links to External Site)
|
Updated: Feb 23 2005
|
Original Entry Date: Oct 7 2004
|
Impact:
Execution of arbitrary code via local system, Execution of arbitrary code via network, Root access via local system, User access via local system, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.1.19 and prior versions
|
Description:
Two vulnerabilities were reported in Cyrus SASL. A local user may be able to gain elevated privileges on the target system. A remote user may be able to execute arbitrary code on the target system.
The vendor reported that a local user may be able to modify the SASL_PATH environment variable to cause a privileged application to load alternate library files from an arbitrary user-specified directory, resulting in the execution of arbitrary code [CVE: CAN-2004-0884].
Gentoo reported that there is also a buffer overflow in 'digestmda5.c' [CVE: CAN-2005-0373]. A remote user may be able to execute arbitrary code on the target system.
|
Impact:
A local user may be able to gain elevated privileges on the target system.
A remote user may be able to execute arbitrary code on the target system.
|
Solution:
A patch for the environment variable flaw is available at:
https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c.diff?r1=1.103&r2=1.104
A fix for the buffer overflow is included in version 2.1.19, available at:
http://asg.web.cmu.edu/sasl/sasl-library.html
|
Vendor URL: asg.web.cmu.edu/sasl/ (Links to External Site)
|
Cause:
Access control error, Boundary error, Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 7 Oct 2004 13:35:30 -0400
Subject: [none]
|
Two vulnerabilities were reported in Cyrus SASL.
A local user may be able to modify the SASL_PATH environment variable to cause a
privileged application to load alternate library files from an arbitrary user-specified
directory, resulting in the execution of arbitrary code [CVE: CAN-2004-0884].
A patch is available at:
https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c.diff?r1=1.103&r2=1.104
Gentoo reported that there is also a buffer overflow in 'digestmda5.c'. A remote user
may be able to execute arbitrary code on the target system. A fix for this overflow
is available in 2.1.19.
Vendor URL: http://asg.web.cmu.edu/sasl/
|
|
