GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client     (CVE-2022-2469)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6169-1 advisory.

    It was discovered that GNU SASL's GSSAPI server could make an out-of-bounds reads if given specially     crafted GSS-API authentication data. A remote attacker could possibly use this issue to cause a denial of     service or to expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5189 advisory.

    Simon Josefsson discovered an out-of-bounds memory read in GNU SASL, an implementation of the Simple     Authentication and Security Layer framework, which could result in denial of service. For the oldstable     distribution (buster), this problem has been fixed in version 1.8.0-8+deb10u1. For the stable distribution     (bullseye), this problem has been fixed in version 1.10.0-4+deb11u1. We recommend that you upgrade your     gsasl packages. For the detailed security status of gsasl please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/gsasl

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
249861	Linux Distros Unpatched Vulnerability : CVE-2022-2469	Nessus	Misc.	high
177354	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : GNU SASL vulnerability (USN-6169-1)	Nessus	Ubuntu Local Security Checks	high
163433	Debian DSA-5189-1 : gsasl - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2022-2469

high

Tenable Plugins

high

high

high