From 178d1c888a90bd18140e9ea572d5fe35bb9a76fc Mon Sep 17 00:00:00 2001 From: nectar Date: Fri, 8 Oct 2004 16:50:15 +0000 Subject: Document unsafe use of environmental variable SASL_PATH in cyrus-sasl. Approved by: portmgr --- security/vuxml/vuln.xml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'security/vuxml') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index ff7d6431eca3..52a9b60d1814 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,37 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> + + cyrus-sasl -- dynamic library loading and set-user-ID + applications + + + cyrus-sasl + 1.5.28_3 + 2.*2.1.19 + + + + +

The Cyrus SASL library, libsasl, contains functions which + may load dynamic libraries. These libraries may be loaded + from the path specified by the environmental variable + SASL_PATH, which in some situations may be fully controlled + by a local attacker. Thus, if a set-user-ID application + (such as chsh) utilizes libsasl, it may be possible for a + local attacker to gain superuser privileges.

+ + + + CAN-2004-0884 + https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104 + + + 2004-09-22 + 2004-10-08 + + + imp3 -- XSS hole in the HTML viewer -- cgit