Vulnerability Description
Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cyrusimap | Cyrus Sasl | <= 2.1.9 |
| Apple | Mac Os X | < 10.3.8 |
| Apple | Mac Os X Server | < 10.3.8 |
Related Weaknesses (CWE)
References
- http://archives.neohapsis.com/archives/linux/suse/2002-q4/1275.htmlBroken Link
- http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557Broken Link
- http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.htmlMailing List
- http://marc.info/?l=bugtraq&m=103946297703402&w=2Mailing ListPatch
- http://www.debian.org/security/2002/dsa-215Broken Link
- http://www.redhat.com/support/errata/RHSA-2002-283.htmlBroken Link
- http://www.securityfocus.com/advisories/4826Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/6347Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/6348Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/6349Broken LinkThird Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10810Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10811Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10812Third Party AdvisoryVDB Entry
- http://archives.neohapsis.com/archives/linux/suse/2002-q4/1275.htmlBroken Link
- http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557Broken Link
FAQ
What is CVE-2002-1347?
CVE-2002-1347 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonical...
How severe is CVE-2002-1347?
CVE-2002-1347 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2002-1347?
Check the references section above for vendor advisories and patch information. Affected products include: Cyrusimap Cyrus Sasl, Apple Mac Os X, Apple Mac Os X Server.