Linux Security
    Linux Security
    Linux Security

    Debian: cyrus-sasl arbitrary code execution real fix

    Date 12 Oct 2004
    2876
    Posted By LinuxSecurity Advisories
    This advisory corrects DSA 563-1 which contained a library that caused other programs to fail unindented.
    
    --------------------------------------------------------------------------
    Debian Security Advisory DSA 563-2                     This email address is being protected from spambots. You need JavaScript enabled to view it. 
    https://www.debian.org/security/                             Martin Schulze
    October 12th, 2004                       https://www.debian.org/security/faq
    --------------------------------------------------------------------------
    
    Package        : cyrus-sasl
    Vulnerability  : unsanitised input
    Problem-Type   : local
    Debian-specific: no
    CVE ID         : CAN-2004-0884
    Debian Bug     : 275498
    
    This advisory corrects DSA 563-1 which contained a library that caused
    other programs to fail unindented.
    
    For the stable distribution (woody) this problem has been fixed in
    version 1.5.27-3woody3.
    
    For reference the advisory text follows:
    
      A vulnerability has been discovered in the Cyrus implementation of
      the SASL library, the Simple Authentication and Security Layer, a
      method for adding authentication support to connection-based
      protocols.  The library honors the environment variable SASL_PATH
      blindly, which allows a local user to link against a malicious
      library to run arbitrary code with the privileges of a setuid or
      setgid application.
    
      For the unstable distribution (sid) this problem has been fixed in
      version 1.5.28-6.2 of cyrus-sasl and in version 2.1.19-1.3 of
      cyrus-sasl2.
    
    We recommend that you upgrade your libsasl packages.
    
    
    Upgrade Instructions
    --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.0 alias woody
    --------------------------------
    
      Source archives:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/cyrus-sasl_1.5.27-3woody3.dsc
          Size/MD5 checksum:      711 91b4d0c36b104620ec5d67a95908da5a
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/cyrus-sasl_1.5.27-3woody3.diff.gz
          Size/MD5 checksum:    40428 56130ac3dde75943d2f5d594881d4f31
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/cyrus-sasl_1.5.27.orig.tar.gz
          Size/MD5 checksum:   528252 76ea426e2e2da3b8d2e3a43af5488f3b
    
      Alpha architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_alpha.deb
          Size/MD5 checksum:    76226 7450c31b1634f789234dcd045c72ba1c
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_alpha.deb
          Size/MD5 checksum:    19100 80dff5ceced2b6902557e2f2753b2c10
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_alpha.deb
          Size/MD5 checksum:    14944 1ebe9da02e5fa969591472fc1d7d86a2
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_alpha.deb
          Size/MD5 checksum:   172332 d4c236501921a441e5bdbe97f18e3818
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_alpha.deb
          Size/MD5 checksum:    13422 43012f7ffc98161bf238d1eccd124c1b
    
      ARM architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_arm.deb
          Size/MD5 checksum:    70170 d4cdf775981a8f4bb41f4aec28562862
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_arm.deb
          Size/MD5 checksum:    15038 c34c52e62a3ecd1099daca1146a2c325
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_arm.deb
          Size/MD5 checksum:    12450 8cc784fd0e7a9f6c3fc8c85440f5d0da
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_arm.deb
          Size/MD5 checksum:   165914 32d2be1e5f58283b36d65904857c38d7
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_arm.deb
          Size/MD5 checksum:    10850 bba9b1694a4ea2bbbc533a029b589b26
    
      Intel IA-32 architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_i386.deb
          Size/MD5 checksum:    65292 91c7e706fbc6d6bf211960d8e4811eb2
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_i386.deb
          Size/MD5 checksum:    13298 433d2d981444495e6ca5e216543c8943
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_i386.deb
          Size/MD5 checksum:    11754 c97a58448542f29a1067291b52b94780
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_i386.deb
          Size/MD5 checksum:   162896 3b0e73e6f1425d9c5fad18377961d84b
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_i386.deb
          Size/MD5 checksum:    11078 ab906f86340a0b5c5f0bb3df8cdd5c9b
    
      Intel IA-64 architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_ia64.deb
          Size/MD5 checksum:    83792 05302af9b91315c201c9c92cd5fe61ff
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_ia64.deb
          Size/MD5 checksum:    23252 c86b8f1bc3b75a25e05c5c63738c3e4e
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_ia64.deb
          Size/MD5 checksum:    19964 75a969bda18dbd3b6d9b8a5a257ed71e
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_ia64.deb
          Size/MD5 checksum:   180990 d03f4ab68d2e9934561ed1852671df3d
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_ia64.deb
          Size/MD5 checksum:    14238 133ec7ac7d983036bd0b098856239272
    
      HP Precision architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_hppa.deb
          Size/MD5 checksum:    75324 0b802ea7f227d06d0de2b1d6c255d3ba
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_hppa.deb
          Size/MD5 checksum:    18286 2ee50c0ea3d8d2904d737edbf6f51736
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_hppa.deb
          Size/MD5 checksum:    15470 ab652ce834c1a1946009402886a940bb
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_hppa.deb
          Size/MD5 checksum:   171242 d83593d56f74ee92998a804dbb2cf67c
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_hppa.deb
          Size/MD5 checksum:    11904 9484fe5429cda40dc6083537dd17426b
    
      Motorola 680x0 architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_m68k.deb
          Size/MD5 checksum:    64738 a4b399d98655e6ee77241227ee86c2e2
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_m68k.deb
          Size/MD5 checksum:    13102 1c3e8fa88d42d621420fb9d8e1607573
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_m68k.deb
          Size/MD5 checksum:    11804 0608eb94698ee5fc87159f686f34d039
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_m68k.deb
          Size/MD5 checksum:   162838 ba3d43e64daec7da2a2eeb47c394db8a
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_m68k.deb
          Size/MD5 checksum:    10908 8f70e837ed7167d96b5ca9e4fd55c9e9
    
      Big endian MIPS architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_mips.deb
          Size/MD5 checksum:    72916 8c174e6a6e519114662ee701f4200936
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_mips.deb
          Size/MD5 checksum:    15946 b18ecabdb2e35db13beffca809e23487
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_mips.deb
          Size/MD5 checksum:    13346 d1764e156b4ed3c1e5f7eaf2a559bcf0
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_mips.deb
          Size/MD5 checksum:   165812 960d06d45f9740419f9c0b73b593c3bd
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_mips.deb
          Size/MD5 checksum:    11318 11682f55a6c99e156d6314f92dd4aa0b
    
      Little endian MIPS architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_mipsel.deb
          Size/MD5 checksum:    72966 c9b7a298d89d3c7d9c7e36ee7f463ad9
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_mipsel.deb
          Size/MD5 checksum:    16262 fd4ca17e75656bfe0e49686fc746ca54
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_mipsel.deb
          Size/MD5 checksum:    13292 3bf13fa11ea13520fda7491ec27948df
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_mipsel.deb
          Size/MD5 checksum:   165918 76d312c85fb2393fe6c2d0ffbf6689e3
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_mipsel.deb
          Size/MD5 checksum:    11280 3e3bda9496b303fc6e1e053b9fb723de
    
      PowerPC architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_powerpc.deb
          Size/MD5 checksum:    70918 6eee1277a09b70eb561aec3eff80111a
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_powerpc.deb
          Size/MD5 checksum:    16076 592393749a7d6475d8cb5cf5d5d901cf
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_powerpc.deb
          Size/MD5 checksum:    13468 83bc3efbfd45d77fdd7a6d93c9417a90
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_powerpc.deb
          Size/MD5 checksum:   166594 ecb898c16ad7b6350ac0aadb369320d6
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_powerpc.deb
          Size/MD5 checksum:    11002 402a89f71a142ba2ccb5189211d8a12e
    
      IBM S/390 architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_s390.deb
          Size/MD5 checksum:    67026 9b21bb28b3a4c8cee9de0b35da4f7cf0
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_s390.deb
          Size/MD5 checksum:    14410 72ab4e29865eb17710ec25189c5f535d
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_s390.deb
          Size/MD5 checksum:    12392 a5a3dc484a9733e0b3e404d2589f8915
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_s390.deb
          Size/MD5 checksum:   165406 3f8dec1387c80bfeaf8d2878f3f8acbc
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_s390.deb
          Size/MD5 checksum:    11626 d08b68882e58c36950a998a081a3b5d5
    
      Sun Sparc architecture:
    
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-dev_1.5.27-3woody3_sparc.deb
          Size/MD5 checksum:    68252 52186d78b3ad3fb76c5fe707d77d9b75
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-digestmd5-plain_1.5.27-3woody3_sparc.deb
          Size/MD5 checksum:    14802 d2b0a39fa2e4dac6836ff1cc4b179838
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl-modules-plain_1.5.27-3woody3_sparc.deb
          Size/MD5 checksum:    11908 3e58d976ae3867e9e8829b5956f2271a
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/libsasl7_1.5.27-3woody3_sparc.deb
          Size/MD5 checksum:   164874 9632f56622cd4cb1f0489b8188da45dd
         https://security.debian.org/pool/updates/main/c/cyrus-sasl/sasl-bin_1.5.27-3woody3_sparc.deb
          Size/MD5 checksum:    13556 fb4002c8597e495fef0c3ff410442534
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    ---------------------------------------------------------------------------------
    For apt-get: deb  https://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  https://packages.debian.org/
    
    

    LinuxSecurity Poll

    I agree with Linus Torvalds - Apple's new M1-powered laptops should run on Linux.

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).
    /main-polls/45-i-agree-with-linus-torvalds-apple-s-new-m1-powered-laptops-should-run-on-linux?task=poll.vote&format=json
    45
    radio
    [{"id":"158","title":"True","votes":"18","type":"x","order":"1","pct":3.5,"resources":[]},{"id":"159","title":"False","votes":"496","type":"x","order":"2","pct":96.5,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.