CVE - CVE-2002-1347

CVE-ID
CVE-2002-1347	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
APPLE:APPLE-SA-2005-03-21 URL:http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html BID:6347 URL:http://www.securityfocus.com/bid/6347 BID:6348 URL:http://www.securityfocus.com/bid/6348 BID:6349 URL:http://www.securityfocus.com/bid/6349 BUGTRAQ:20021209 Cyrus SASL library buffer overflows URL:http://marc.info/?l=bugtraq&m=103946297703402&w=2 CONECTIVA:000557 URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557 DEBIAN:DSA-215 URL:http://www.debian.org/security/2002/dsa-215 GENTOO:200212-10 URL:http://www.securityfocus.com/advisories/4826 REDHAT:RHSA-2002:283 URL:http://www.redhat.com/support/errata/RHSA-2002-283.html SUSE:SuSE-SA:2002:048 URL:http://archives.neohapsis.com/archives/linux/suse/2002-q4/1275.html XF:cyrus-sasl-logwriter-bo(10812) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/10812 XF:cyrus-sasl-saslauthd-bo(10811) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/10811 XF:cyrus-sasl-username-bo(10810) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/10810
Assigning CNA
MITRE Corporation
Date Record Created
20021210	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Modified (20071017)
Votes (Legacy)
ACCEPT(3) Cole, Cox, Green
Comments (Legacy)

Proposed (Legacy)
20030317
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)