CVE-2006-1721

Name	CVE-2006-1721
Description	digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of service (segmentation fault) via malformed inputs in DIGEST-MD5 negotiation.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1042-1
Debian Bugs	361937

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cyrus-sasl2 (PTS)	buster, buster (security)	2.1.27+dfsg-1+deb10u2	fixed
	bullseye (security), bullseye	2.1.27+dfsg-2.1+deb11u1	fixed
	bookworm	2.1.28+dfsg-10	fixed
	trixie	2.1.28+dfsg1-4	fixed
	sid	2.1.28+dfsg1-6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cyrus-sasl2	source	woody	(not affected)		DSA-1042-1
cyrus-sasl2	source	sarge	2.1.19-1.5sarge1		DSA-1042-1
cyrus-sasl2	source	(unstable)	2.1.19.dfsg1-0.2	low		361937
cyrus-sasl2-mit	source	(unstable)	(not affected)

- cyrus-sasl2-mit <not-affected> (does not install digest-md5)