Sign-up

ID

VAR-200410-0047


CVE

CVE-2005-0373


TITLE

Cyrus SASL SASL_PATH Environment variable privilege escalation vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200410-006

DESCRIPTION

Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code. Cyrus SASL is affected by multiple critical vulnerabilities that may be remotely exploitable. The first issue is due to a boundary condition error, the second issue is due to a failure of the application to properly handle environment variables. Information currently available regarding these issues is insufficient to provide a more detailed analysis. This BID will be updated and split into separate BIDs when more information becomes available. An attacker can leverage the boundary condition issue to exploit arbitrary code on the affected computer. The impact of the environment variable issue is currently unknown. Cyrus SASL provides several open source implementations for security authentication. Cyrus SASL incorrectly handles the SASL_PATH environment variable, which could be exploited by a local attacker for privilege escalation attacks. Attackers can use the SASL_PATH environment variable to make privileged applications load arbitrary library files from any directory specified by the user, which can cause malicious programs to run with high privileges

Trust: 1.35

sources: NVD: CVE-2005-0373 // BID: 11347 // VULHUB: VHN-11582 // VULMON: CVE-2005-0373

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:eqversion:10.0.4

Trust: 1.6

vendor:applemodel:mac os x serverscope:eqversion:10.2.6

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.1

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0.1

Trust: 1.6

vendor:applemodel:mac os x serverscope:eqversion:10.2.5

Trust: 1.6

vendor:applemodel:mac os x serverscope:eqversion:10.2.4

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0.3

Trust: 1.6

vendor:applemodel:mac os x serverscope:eqversion:10.2.3

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0.2

Trust: 1.6

vendor:susemodel:linuxscope:eqversion:8.0

Trust: 1.3

vendor:openpkgmodel:openpkgscope:eqversion:2.2

Trust: 1.3

vendor:openpkgmodel:openpkgscope:eqversion:2.1

Trust: 1.3

vendor:susemodel:linuxscope:eqversion:8.1

Trust: 1.3

vendor:applemodel:mac os x serverscope:eqversion:10.2.8

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.1.5

Trust: 1.0

vendor:conectivamodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.18_r1

Trust: 1.0

vendor:redhatmodel:fedora corescope:eqversion:core_1.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.1.1

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.1

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:1.0

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.0

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:8.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.4

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.1.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.1.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.5

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.13

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.7

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.16

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.7

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.1.2

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:1.5.28

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.7

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.8

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.8

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.1.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.1.3

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:1.5.27

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.2

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.10

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.6

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:9.2

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.12

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.1.5

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.18

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.1

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:9.1

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.14

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:1.5.24

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.6

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.1

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.1

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.6

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.1.1

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.5

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.1

Trust: 1.0

vendor:susemodel:cvsupscope:eqversion:16.1h_36.i586

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.15

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.9

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.1.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.7

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.17

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.3

Trust: 1.0

vendor:conectivamodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:cyrusmodel:saslscope:eqversion:2.1.11

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.8

Trust: 1.0

vendor:s u s emodel:linux personalscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.8

Trust: 0.3

vendor:s u s emodel:cvsup-16.1h-36.i586.rpmscope: - version: -

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.4

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.15

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.1.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.4

Trust: 0.3

vendor:cyrus utilsmodel:sasl -r1scope:eqversion:2.1.18

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:1.5.27

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.6

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.6

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.9

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.1

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.11

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.10

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.03

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1

Trust: 0.3

vendor:susemodel:linux i386scope:eqversion:8.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.8

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.14

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.3

Trust: 0.3

vendor:s u s emodel:linux personalscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.3

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.17

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.12

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.5

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.8

Trust: 0.3

vendor:s u s emodel:linux personal x86 64scope:eqversion:9.1

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.18

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.5

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:1.5.28

Trust: 0.3

vendor:susemodel:linux desktopscope:eqversion:1.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.1.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.2

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.16

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.6

Trust: 0.3

vendor:s u s emodel:linux personalscope:eqversion:9.2

Trust: 0.3

vendor:s u s emodel:linux personalscope:eqversion:9.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.7

Trust: 0.3

vendor:cyrus utilsmodel:sasl -r2scope:neversion:2.1.18

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.1

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:1.5.24

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.1

Trust: 0.3

vendor:redhatmodel:fedora core1scope: - version: -

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.7

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.8

Trust: 0.3

vendor:s u s emodel:linux personal x86 64scope:eqversion:9.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.1.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.1.3

Trust: 0.3

vendor:s u s emodel:linux personal x86 64scope:eqversion:9.0

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.5

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.3

Trust: 0.3

vendor:cyrus utilsmodel:saslscope:eqversion:2.1.13

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.1.5

Trust: 0.3

vendor:susemodel:linux enterprise serverscope:eqversion:9

Trust: 0.3

sources: BID: 11347 // CNNVD: CNNVD-200410-006 // NVD: CVE-2005-0373

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-0373
value: HIGH

Trust: 1.0

CNNVD: CNNVD-200410-006
value: HIGH

Trust: 0.6

VULHUB: VHN-11582
value: HIGH

Trust: 0.1

VULMON: CVE-2005-0373
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2005-0373
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-11582
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-11582 // VULMON: CVE-2005-0373 // CNNVD: CNNVD-200410-006 // NVD: CVE-2005-0373

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-0373

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200410-006

TYPE

Boundary Condition Error

Trust: 0.9

sources: BID: 11347 // CNNVD: CNNVD-200410-006

EXTERNAL IDS

db:BIDid:11347

Trust: 2.1

db:NVDid:CVE-2005-0373

Trust: 2.1

db:CNNVDid:CNNVD-200410-006

Trust: 0.7

db:XFid:5

Trust: 0.6

db:XFid:17642

Trust: 0.6

db:MLISTid:[OPENBSD-PORTS] 20040717 UPDATE: CYRUS-SASL-2.1.19

Trust: 0.6

db:GENTOOid:GLSA-200410-05

Trust: 0.6

db:SUSEid:SUSE-SR:2005:006

Trust: 0.6

db:MANDRAKEid:MDKSA-2005:054

Trust: 0.6

db:VULHUBid:VHN-11582

Trust: 0.1

db:VULMONid:CVE-2005-0373

Trust: 0.1

sources: VULHUB: VHN-11582 // VULMON: CVE-2005-0373 // BID: 11347 // CNNVD: CNNVD-200410-006 // NVD: CVE-2005-0373

REFERENCES

url:http://www.securityfocus.com/bid/11347

Trust: 1.8

url:http://www.gentoo.org/security/en/glsa/glsa-200410-05.xml

Trust: 1.8

url:http://www.mandriva.com/security/advisories?name=mdksa-2005:054

Trust: 1.8

url:http://www.monkey.org/openbsd/archive/ports/0407/msg00265.html

Trust: 1.8

url:http://www.linuxcompatible.org/print42495.html

Trust: 1.8

url:https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c.diff?r1=1.170&r2=1.171

Trust: 1.7

url:https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c?rev=1.171&content-type=text/x-cvsweb-markup

Trust: 1.7

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/17642

Trust: 1.2

url:http://xforce.iss.net/xforce/xfdb/17642

Trust: 0.6

url:http://docs.info.apple.com/article.html?artnum=301061

Trust: 0.3

url:http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000959

Trust: 0.3

url:http://asg.web.cmu.edu/cyrus/

Trust: 0.3

url:http://asg.web.cmu.edu/sasl/

Trust: 0.3

url:http://rhn.redhat.com/errata/rhsa-2004-546.html

Trust: 0.3

url:https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c.diff?r1=1.170&r2=1.171

Trust: 0.1

url:https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c?rev=1.171&content-type=text/x-cvsweb-markup

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:http://tools.cisco.com/security/center/viewalert.x?alertid=8238

Trust: 0.1

url:https://www.rapid7.com/db/vulnerabilities/linuxrpm-rhsa-2004-546

Trust: 0.1

sources: VULHUB: VHN-11582 // VULMON: CVE-2005-0373 // BID: 11347 // CNNVD: CNNVD-200410-006 // NVD: CVE-2005-0373

CREDITS

Cyrus

Trust: 0.6

sources: CNNVD: CNNVD-200410-006

SOURCES

db:VULHUBid:VHN-11582
db:VULMONid:CVE-2005-0373
db:BIDid:11347
db:CNNVDid:CNNVD-200410-006
db:NVDid:CVE-2005-0373

LAST UPDATE DATE

2024-08-14T12:27:39.798000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-11582date:2017-07-11T00:00:00
db:VULMONid:CVE-2005-0373date:2017-07-11T00:00:00
db:BIDid:11347date:2009-07-12T07:06:00
db:CNNVDid:CNNVD-200410-006date:2005-10-20T00:00:00
db:NVDid:CVE-2005-0373date:2017-07-11T01:32:15.687

SOURCES RELEASE DATE

db:VULHUBid:VHN-11582date:2004-10-07T00:00:00
db:VULMONid:CVE-2005-0373date:2004-10-07T00:00:00
db:BIDid:11347date:2004-10-07T00:00:00
db:CNNVDid:CNNVD-200410-006date:2004-10-07T00:00:00
db:NVDid:CVE-2005-0373date:2004-10-07T04:00:00