The Cyrus SASL library contains a buffer overflow vulnerability that could allow an attacker to execute code or cause a vulnerable program to crash.
SASL (Simple Authentication and Security Layer) is a method for adding authentication support to various protocols. SASL is commonly used by mail servers to request authentication from clients and by clients to authenticate to servers.
The sasl_encode64() function converts a string into base64. The Cyrus SASL library contains buffer overflows that occur because of unsafe use of the sasl_encode64() function.
A remote attacker might be able to execute code, or cause any programs relying on SASL to crash or be unavailable.
Thanks to James Ralston for reporting this issue and providing technical information.
This document was written by Ryan Giobbi.
|Date First Published:||2009-05-14|
|Date Last Updated:||2009-08-26 13:19 UTC|