CVE-2002-1347

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.

Desbordamiento de búfer en la librería Cyrus SASL 2.1.9 y anteriores permite a atacantes remotos causar una denegación de servicio y posiblemente ejecutar código arbitrario mediante

entradas largas durante la canonización de nombre de usuario
caractéres que necesitan ser escapados durante autenticación LDAP usando saslauth, o
un error por uno en el escritor del log, que no asigna espacio para el carácter nulo que termina la cadena.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2002-12-10 CVE Reserved
2002-12-11 CVE Published
2024-04-20 EPSS Updated
2024-08-08 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-131: Incorrect Calculation of Buffer Size

CAPEC

References (13)

URL	Tag	Source
http://www.securityfocus.com/bid/6347	Broken Link
http://www.securityfocus.com/bid/6348	Broken Link
http://www.securityfocus.com/bid/6349	Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/10810	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/10811	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/10812	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://marc.info/?l=bugtraq&m=103946297703402&w=2	2024-02-02

URL	Date	SRC
http://archives.neohapsis.com/archives/linux/suse/2002-q4/1275.html	2024-02-02
http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557	2024-02-02
http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html	2024-02-02
http://www.debian.org/security/2002/dsa-215	2024-02-02
http://www.redhat.com/support/errata/RHSA-2002-283.html	2024-02-02
http://www.securityfocus.com/advisories/4826	2024-02-02

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cyrusimap Search vendor "Cyrusimap"		Cyrus Sasl Search vendor "Cyrusimap" for product "Cyrus Sasl"				<= 2.1.9 Search vendor "Cyrusimap" for product "Cyrus Sasl" and version " <= 2.1.9"		-		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				< 10.3.8 Search vendor "Apple" for product "Mac Os X" and version " < 10.3.8"		-		Affected
Apple Search vendor "Apple"		Mac Os X Server Search vendor "Apple" for product "Mac Os X Server"				< 10.3.8 Search vendor "Apple" for product "Mac Os X Server" and version " < 10.3.8"		-		Affected