The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASL_PATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application (such as chsh) utilizes libsasl, it may be possible for a local attacker to gain superuser privileges.

The remote host is missing Security Update 2005-003. This security update contains security fixes for the following applications :

  - AFP Server
  - Bluetooth Setup Assistant
  - Core Foundation
  - Cyrus IMAP
  - Cyrus SASL
  - Folder Permissions
  - Mailman
  - Safari

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. The library honors the environment variable SASL_PATH blindly, which allows a local user to link against a malicious library to run arbitrary code with the privileges of a setuid or setgid application.

The MIT version of the Cyrus implementation of the SASL library provides bindings against MIT GSSAPI and MIT Kerberos4.

This advisory is an addition to DSA 563-1 and 563-2 which weren't able to supersede the library on sparc and arm due to a different version number for them in the stable archive. Other architectures were updated properly. Another problem was reported in connection with sendmail, though, which should be fixed with this update as well.

At application startup, libsasl and libsasl2 attempt to build a list of all SASL plug-ins which are available on the system. To do so, the libraries search for and attempt to load every shared library found within the plug-in directory. This location can be set with the SASL_PATH environment variable.

In situations where an untrusted local user can affect the environment of a privileged process, this behavior could be exploited to run arbitrary code with the privileges of a setuid or setgid application.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0884 to this issue.

Users of cyrus-sasl should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated cyrus-sasl packages that fix a setuid and setgid application vulnerability are now available.

[Updated 7th October 2004] Revised cryus-sasl packages have been added for Red Hat Enterprise Linux 3; the patch in the previous packages broke interaction with ldap.

The cyrus-sasl package contains the Cyrus implementation of SASL. SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols.

At application startup, libsasl and libsasl2 attempts to build a list of all available SASL plug-ins which are available on the system. To do so, the libraries search for and attempt to load every shared library found within the plug-in directory. This location can be set with the SASL_PATH environment variable.

In situations where an untrusted local user can affect the environment of a privileged process, this behavior could be exploited to run arbitrary code with the privileges of a setuid or setgid application.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0884 to this issue.

Users of cyrus-sasl should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

A vulnerability was discovered in the libsasl library of cyrus-sasl.
libsasl honors the SASL_PATH environment variable blindly, which could allow a local user to create a malicious 'library' that would get executed with the effective ID of SASL when anything calls libsasl.

The provided packages are patched to protect against this vulnerability.

The remote host is affected by the vulnerability described in GLSA-200410-05 (Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities)

    Cyrus-SASL contains a remote buffer overflow in the digestmda5.c file.
    Additionally, under certain conditions it is possible for a local user     to exploit a vulnerability in the way the SASL_PATH environment     variable is honored (CAN-2004-0884).
  Impact :

    An attacker might be able to execute arbitrary code with the Effective     ID of the application calling the Cyrus-SASL libraries.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
37777	FreeBSD : cyrus-sasl -- dynamic library loading and set-user-ID applications (92268205-1947-11d9-bc4a-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	high
17587	Mac OS X Multiple Vulnerabilities (Security Update 2005-003)	Nessus	MacOS X Local Security Checks	high
15666	Debian DSA-568-1 : cyrus-sasl-mit - unsanitised input	Nessus	Debian Local Security Checks	high
15661	Debian DSA-563-3 : cyrus-sasl - unsanitised input	Nessus	Debian Local Security Checks	high
15454	Fedora Core 2 : cyrus-sasl-2.1.18-2.2 (2004-332)	Nessus	Fedora Local Security Checks	high
15441	RHEL 2.1 / 3 : cyrus-sasl (RHSA-2004:546)	Nessus	Red Hat Local Security Checks	high
15435	Mandrake Linux Security Advisory : cyrus-sasl (MDKSA-2004:106)	Nessus	Mandriva Local Security Checks	high
15431	GLSA-200410-05 : Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2004-0884

critical

Tenable Plugins

high

high

high

high

high

high

high

high