2

USN-790-1: Cyrus SASL vulnerability

view story
linux-howto

http://www.ubuntu.com – Referenced CVEs:  CVE-2009-0688 Description:  =========================================================== Ubuntu Security Notice USN-790-1 June 24, 2009 cyrus-sasl2 vulnerability CVE-2009-0688 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: libsasl2 2.1.19.dfsg1-0.1ubuntu3.1 Ubuntu 8.04 LTS: libsasl2-2 2.1.22.dfsg1-18ubuntu2.1 Ubuntu 8.10: libsasl2-2 2.1.22.dfsg1-21ubuntu2.1 Ubuntu 9.04: libsasl2-2 2.1.22.dfsg1-23ubuntu3.1 After a standard system upgrade you need to restart services using SASL to effect the necessary changes. Details follow: James Ralston discovered that the Cyrus SASL base64 encoding function could be used unsafely. If a remote attacker sent a specially crafted request to a service that used SASL, it could lead to a loss of privacy, or crash the application, resulting in a denial of service. (Distributions)