Cyrus SASL Library Logging Memory Corruption Vulnerability
BID:6349
Info
Cyrus SASL Library Logging Memory Corruption Vulnerability
| Bugtraq ID: | 6349 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-1347 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 09 2002 12:00AM |
| Updated: | Jul 11 2009 07:16PM |
| Credit: | Discovery of this vulnerability is credited to Timo Sirainen <[email protected]>. |
| Vulnerable: |
Cyrus-Utils SASL 2.1.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.1.5 Apple Mac OS X Server 10.1.4 Apple Mac OS X Server 10.1.3 Apple Mac OS X Server 10.1.2 Apple Mac OS X Server 10.1.1 Apple Mac OS X Server 10.1 Apple Mac OS X Server 10.0 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 3 Apple Mac OS X 10.0 |
| Not Vulnerable: |
Cyrus-Utils SASL 2.1.10 Cyrus-Utils SASL 1.5.28 |
Discussion
Cyrus SASL Library Logging Memory Corruption Vulnerability
A memory corruption vulnerability has been discovered in SASL when generating logs files. It has been reported that under some circumstances SASL fails to allocate sufficient memory for string used in log entries. By causing Cyrus to generate a malicious log it may be possible for an attacker to corrupt memory.
This could potentially be exploited to overwrite the LSB of a sensitive variable or possibly cause inaccurate logs to be created.
It should be noted that although this vulnerability was discovered in Cyrus, it may also affect other programs that utilize the SASL library.
A memory corruption vulnerability has been discovered in SASL when generating logs files. It has been reported that under some circumstances SASL fails to allocate sufficient memory for string used in log entries. By causing Cyrus to generate a malicious log it may be possible for an attacker to corrupt memory.
This could potentially be exploited to overwrite the LSB of a sensitive variable or possibly cause inaccurate logs to be created.
It should be noted that although this vulnerability was discovered in Cyrus, it may also affect other programs that utilize the SASL library.
Exploit / POC
Cyrus SASL Library Logging Memory Corruption Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Cyrus SASL Library Logging Memory Corruption Vulnerability
Solution:
It is recommended that all Gentoo Linux users who are running
dev-libs/cyrus-sasl-2.1.9 update their systems as follows:
emerge rsync
emerge cyrus-sasl
emerge clean
This issue has been fixed in version 2.1.10. Users are advised to upgrade as soon as possible.
Apple has released advisory (Security Update 2005-003) to address various issues. Please see the referenced advisory for more information. Updates for Mac OS X v10.3.8 and Mac OS X Server v10.3.8 are available.
Apple Mac OS X 10.3.8
Apple Mac OS X Server 10.3.8
Cyrus-Utils SASL 2.1.9
Solution:
It is recommended that all Gentoo Linux users who are running
dev-libs/cyrus-sasl-2.1.9 update their systems as follows:
emerge rsync
emerge cyrus-sasl
emerge clean
This issue has been fixed in version 2.1.10. Users are advised to upgrade as soon as possible.
Apple has released advisory (Security Update 2005-003) to address various issues. Please see the referenced advisory for more information. Updates for Mac OS X v10.3.8 and Mac OS X Server v10.3.8 are available.
Apple Mac OS X 10.3.8
-
Apple SecUpd2005-003Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05529&plat form=osx&method=sa/SecUpd2005-003Pan.dmg
Apple Mac OS X Server 10.3.8
-
Apple SecUpdSrvr2005-003Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05530&plat form=osx&method=sa/SecUpdSrvr2005-003Pan.dmg
Cyrus-Utils SASL 2.1.9
-
Cyrus SASL 2.1.10
ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-2.1.10.tar.gz -
RedHat cyrus-sasl-2.1.10-1.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/cyrus-sasl-2.1.10-1.i386.rpm -
RedHat cyrus-sasl-devel-2.1.10-1.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/cyrus-sasl-devel-2.1.10-1.i386 .rpm -
RedHat cyrus-sasl-gssapi-2.1.10-1.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/cyrus-sasl-gssapi-2.1.10-1.i38 6.rpm -
RedHat cyrus-sasl-md5-2.1.10-1.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/cyrus-sasl-md5-2.1.10-1.i386.r pm -
RedHat cyrus-sasl-plain-2.1.10-1.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/cyrus-sasl-plain-2.1.10-1.i386 .rpm
References
Cyrus SASL Library Logging Memory Corruption Vulnerability
References:
References:
- About Security Update 2005-003 (Apple)