cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
cyrus-sasl (también se conoce como Cyrus SASL) versión 2.1.27, presenta una escritura fuera de límites conllevando a una denegación de servicio remota no autenticada en OpenLDAP por medio de un paquete LDAP malformado. El bloqueo de OpenLDAP es causado en última instancia por un error por un paso en la función _sasl_add_string en el archivo common.c en cyrus-sasl.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-193
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| cyrusimap | cyrus-sasl | * | <built-in method update of dict object at 0x7fd36b86d9c0> | Application |
| debian | debian_linux | 8.0 | <built-in method update of dict object at 0x7fd36b86f8c0> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd369f82400> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd2d399af40> | Operating System |
| canonical | ubuntu_linux | 12.04 | <built-in method update of dict object at 0x7fd36b86d380> | Operating System |
| canonical | ubuntu_linux | 14.04 | <built-in method update of dict object at 0x7fd36b86c5c0> | Operating System |
| canonical | ubuntu_linux | 16.04 | <built-in method update of dict object at 0x7fd369f80f00> | Operating System |
| canonical | ubuntu_linux | 18.04 | <built-in method update of dict object at 0x7fd36b261040> | Operating System |
| canonical | ubuntu_linux | 19.10 | <built-in method update of dict object at 0x7fd36b86e740> | Operating System |
| fedoraproject | fedora | 31 | <built-in method update of dict object at 0x7fd36b86ce40> | Operating System |
| fedoraproject | fedora | 32 | <built-in method update of dict object at 0x7fd384e29ac0> | Operating System |
| redhat | jboss_enterprise_web_server | 2.0.0 | <built-in method update of dict object at 0x7fd36b86c9c0> | Application |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd36b89e740> | Operating System |
| redhat | enterprise_linux | 5.0 | <built-in method update of dict object at 0x7fd384639380> | Operating System |
| redhat | enterprise_linux | 6.0 | <built-in method update of dict object at 0x7fd2dbcde780> | Operating System |
| redhat | enterprise_linux | 7.0 | <built-in method update of dict object at 0x7fd2d3998840> | Operating System |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7fd36b86d2c0> | Operating System |
| redhat | enterprise_linux_eus | 8.4 | <built-in method update of dict object at 0x7fd2d3b92e40> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0 | <built-in method update of dict object at 0x7fd39c408100> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.4 | <built-in method update of dict object at 0x7fd2d399b280> | Operating System |
| redhat | enterprise_linux_for_power_little_endian | 8.0 | <built-in method update of dict object at 0x7fd2d399a780> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.4 | <built-in method update of dict object at 0x7fd36b86d900> | Operating System |
| redhat | enterprise_linux_server_aus | 8.4 | <built-in method update of dict object at 0x7fd369f80880> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.4 | <built-in method update of dict object at 0x7fd36b86c540> | Operating System |
| redhat | enterprise_linux_server_tus | 8.4 | <built-in method update of dict object at 0x7fd2d3998f00> | Operating System |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 8.4 | <built-in method update of dict object at 0x7fd3703bbb40> | Operating System |
| apple | ipados | 13.6 | <built-in method update of dict object at 0x7fd3840e4f40> | Operating System |
| apple | iphone_os | 13.6 | <built-in method update of dict object at 0x7fd36b260340> | Operating System |
| apple | mac_os_x | * | <built-in method update of dict object at 0x7fd2d3999740> | Operating System |
| apple | mac_os_x | * | <built-in method update of dict object at 0x7fd2d399bb00> | Operating System |
| apple | mac_os_x | * | <built-in method update of dict object at 0x7fd2dbcdd740> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd2d399b5c0> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd36b262a80> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd2dbcdc280> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd2d3998200> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd340b02b00> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd39c40a300> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd39c409d40> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd340cc65c0> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd340cc7240> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd340ac9ec0> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd37035cbc0> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd2d399bf40> | Operating System |
| apple | mac_os_x | 10.13.6 | <built-in method update of dict object at 0x7fd2d399a680> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd340cc6900> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd39c44bd00> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd340a33940> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd2d3999540> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd39deeeb80> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd39c40a100> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd3848e22c0> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd3842b7480> | Operating System |
| apple | mac_os_x | 10.14.6 | <built-in method update of dict object at 0x7fd385453d80> | Operating System |
| apache | bookkeeper | 4.12.1 | <built-in method update of dict object at 0x7fd340af4c80> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:cyrusimap:cyrus-sasl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:apple:ipados:13.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:iphone_os:13.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-003:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:apache:bookkeeper:4.12.1:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:o:centos:centos:7.0:*:*:*:*:*:*:* |