CVE-2009-0688

NameCVE-2009-0688
DescriptionMultiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-1807-1, DTSA-200-1, DTSA-201-1
NVD severityhigh (attack range: remote)
Debian Bugs528749
Debian/oldoldstablenot vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cyrus-sasl2 (PTS)squeeze2.1.23.dfsg1-7fixed
wheezy2.1.25.dfsg1-6+deb7u1fixed
stretch, sid, jessie2.1.26.dfsg1-13fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyrus-sasl2source(unstable)2.1.23.dfsg1-1high528749
cyrus-sasl2sourceetch2.1.22.dfsg1-8+etch1highDSA-1807-1
cyrus-sasl2sourcelenny2.1.22.dfsg1-23+lenny1highDSA-1807-1
cyrus-sasl2sourcesqueeze2.1.22.dfsg1-23+squeeze1highDTSA-200-1
cyrus-sasl2-heimdalsource(unstable)2.1.23.dfsg1-1high
cyrus-sasl2-heimdalsourcelenny2.1.22.dfsg1-23+lenny1highDSA-1807-1
cyrus-sasl2-heimdalsourcesqueeze2.1.22.dfsg1-23+squeeze1highDTSA-201-1

Notes

VU#238019

Search for package or bug name: Reporting problems