Test ID:	1.3.6.1.4.1.25623.1.0.53252
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 563-2 (cyrus-sasl)
Summary:	The remote host is missing an update to cyrus-sasl announced via advisory DSA 563-2.;; This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-563)' (OID: 1.3.6.1.4.1.25623.1.0.53256).
Description:	Summary: The remote host is missing an update to cyrus-sasl announced via advisory DSA 563-2. This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-563)' (OID: 1.3.6.1.4.1.25623.1.0.53256). Vulnerability Insight: This advisory corrects DSA 563-1 which contained a library that caused other programs to fail unindented. For the stable distribution (woody) this problem has been fixed in version 1.5.27-3woody3. For reference the advisory text follows: A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. The library honors the environment variable SASL_PATH blindly, which allows a local user to link against a malicious library to run arbitrary code with the privileges of a setuid or setgid application. For the unstable distribution (sid) this problem has been fixed in version 1.5.28-6.2 of cyrus-sasl and in version 2.1.19-1.3 of cyrus-sasl2. Solution: We recommend that you upgrade your libsasl packages. CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2004-0884 http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html BugTraq ID: 11347 http://www.securityfocus.com/bid/11347 Bugtraq: 20050128 [OpenPKG-SA-2005.004] OpenPKG Security Advisory (sasl) (Google Search) http://marc.info/?l=bugtraq&m=110693126007214&w=2 Computer Incident Advisory Center Bulletin: P-003 http://www.ciac.org/ciac/bulletins/p-003.shtml Debian Security Information: DSA-563 (Google Search) http://www.debian.org/security/2004/dsa-563 Debian Security Information: DSA-568 (Google Search) http://www.debian.org/security/2004/dsa-568 https://bugzilla.fedora.us/show_bug.cgi?id=2137 http://www.gentoo.org/security/en/glsa/glsa-200410-05.xml http://www.mandriva.com/security/advisories?name=MDKSA-2004:106 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11678 RedHat Security Advisories: RHSA-2004:546 http://rhn.redhat.com/errata/RHSA-2004-546.html http://www.trustix.net/errata/2004/0053/ XForce ISS Database: cyrus-sasl-saslpath(17643) https://exchange.xforce.ibmcloud.com/vulnerabilities/17643
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.