CVE-2009-0688
Summary
| CVE | CVE-2009-0688 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-05-15 15:30:00 UTC |
| Updated | 2017-09-29 01:33:00 UTC |
| Description | Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c. |
Risk And Classification
Problem Types: CWE-119
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Sun Solaris SASL Library Buffer Overflow Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| 54515 | OSVDB | osvdb.org | |
| ASA-2009-184 (SUN 259148) | CONFIRM | support.avaya.com | |
| Cyrus SASL 'sasl_encode64()' Remote Buffer Overflow Vulnerability | BID | www.securityfocus.com | Patch |
| Oracle Critical Patch Update Advisory - April 2010 | CONFIRM | www.oracle.com | |
| USN-790-1: Cyrus SASL vulnerability | Ubuntu | UBUNTU | www.ubuntu.com | |
| US-CERT Vulnerability Note VU#238019 | CERT-VN | www.kb.cert.org | Patch, US Government Resource |
| ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-2.1.23.tar.gz | CONFIRM | ftp.andrew.cmu.edu | Patch |
| Cyrus SASL Buffer Overflow in sasl_encode64 Lets Remote Users Execute Arbitrary Code - SecurityTracker | SECTRACK | www.securitytracker.com | |
| US-CERT Technical Cyber Security Alert TA10-103B -- Oracle Updates for Multiple Vulnerabilities | CERT | www.us-cert.gov | US Government Resource |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| #259148: Security Vulnerability in the Solaris Simple Authentication and Security Layer (SASL) Library (see libsasl(3LIB)) Routine sasl_encode64(3SASL) may Allow Unprivileged Users to Crash Applications Using this Function | SUNALERT | sunsolve.sun.com | |
| Gentoo update for cyrus-sasl - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| Debian -- Security Information -- DSA-1807-1 cyrus-sasl2, cyrus-sasl2-heimdal | DEBIAN | www.debian.org | |
| 264248 | SUNALERT | sunsolve.sun.com | |
| Advisories:rPSA-2009-0091 - rPath Wiki | CONFIRM | wiki.rpath.com | |
| rPath update for cyrus-sasl - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| APPLE-SA-2010-03-29-1 Security Update 2010-002 / Mac OS X v10.6.3 | APPLE | lists.apple.com | |
| Slackware update for cyrus-sasl - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| Red Hat update for cyrus-imapd - Secunia.com | SECUNIA | secunia.com | |
| #273910: This Alert covers CVE-2009-2404 and CVE-2009-0688 for the Directory Server component of the Sun ONE Directory Server and Sun Java System Directory Server products. | SUNALERT | sunsolve.sun.com | |
| SUSE Update for Multiple Packages - Advisories - Community | SECUNIA | secunia.com | |
| 1020755 | SUNALERT | sunsolve.sun.com | |
| Avaya CMS Solaris SASL Library Buffer Overflow Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| Sun Java System Directory Server Two Vulnerabilities - Secunia.com | SECUNIA | secunia.com | |
| Support / Security / Advisories / / MDVSA-2009:113 | Mandriva | MANDRIVA | www.mandriva.com | |
| Debian update for cyrus-sasl2 and cyrus-sasl2-heimdal - Secunia.com | SECUNIA | secunia.com | |
| 54514 | OSVDB | osvdb.org | |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| The Slackware Linux Project: Slackware Security Advisories | SLACKWARE | slackware.com | |
| 1021699 | SUNALERT | sunsolve.sun.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| Cyrus SASL "sasl_encode64()" Buffer Overflow Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| About the security content of Security Update 2010-002 / Mac OS X v10.6.3 | CONFIRM | support.apple.com | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Gentoo Linux Documentation -- Cyrus-SASL: Execution of arbitrary code | GENTOO | security.gentoo.org | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2009:011 | SUSE | lists.opensuse.org | |
| Support | REDHAT | www.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-06-19 | Tomas Hoger | The upstream fix for this issue is not backwards compatible and introduces an ABI change not allowed in Red Hat Enterprise Linux. Therefore, there is no plan to address this problem directly in cyrus-sasl packages. All applications shipped in Red Hat Enterprise Linux and using affected sasl_encode64() function were investigated and patched if their use of the function could have security consequences. See following bug report for further details: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0688#c20 |
There are currently no legacy QID mappings associated with this CVE.