CVE-2009-0688

NameCVE-2009-0688
DescriptionMultiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1807-1, DTSA-200-1, DTSA-201-1
NVD severityhigh (attack range: remote)
Debian Bugs528749

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cyrus-sasl2 (PTS)wheezy2.1.25.dfsg1-6+deb7u1fixed
jessie (security), jessie2.1.26.dfsg1-13+deb8u1fixed
stretch, sid2.1.26.dfsg1-15fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyrus-sasl2source(unstable)2.1.23.dfsg1-1high528749
cyrus-sasl2sourceetch2.1.22.dfsg1-8+etch1highDSA-1807-1
cyrus-sasl2sourcelenny2.1.22.dfsg1-23+lenny1highDSA-1807-1
cyrus-sasl2sourcesqueeze2.1.22.dfsg1-23+squeeze1highDTSA-200-1
cyrus-sasl2-heimdalsource(unstable)2.1.23.dfsg1-1high
cyrus-sasl2-heimdalsourcelenny2.1.22.dfsg1-23+lenny1highDSA-1807-1
cyrus-sasl2-heimdalsourcesqueeze2.1.22.dfsg1-23+squeeze1highDTSA-201-1

Notes

VU#238019

Search for package or bug name: Reporting problems