OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2005.004
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2005.004
Advisory Published:      2008-10-06 16:00 UTC

Issue Id (internal):     OpenPKG-SI-20050128.01
Issue First Created:     2005-01-28
Issue Last Modified:     2006-11-28
Issue Revision:          06


Subject Name:            SASL
Subject Summary:         Simple Authentication and Security Layer (SASL)
Subject Home:            http://asg.web.cmu.edu/sasl/
Subject Versions:        * <= 2.1.19

Vulnerability Id:        CVE-2004-0884
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           local system
Attack Impact:           arbitrary code execution

Description:
    A setuid and setgid application vulnerability was found in the Cyrus
    SASL library [0]. At application startup, libsasl2 attempts to build a
    list of all available SASL plugins which are available on the system.
    To do so, the library searches for and attempts to load every shared
    library found within the plugin directory. This location can be set
    with the SASL_PATH environment variable.
    
    In situations where an untrusted local user can affect the environment
    of a privileged process, this behavior could be exploited to run
    arbitrary code with the privileges of a setuid or setgid application.

References:
    [0] http://asg.web.cmu.edu/sasl/
    [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0884
    [2] http://www.openpkg.org/tutorial.html#regular-source
    [3] http://www.openpkg.org/tutorial.html#regular-binary
    [4] ftp://ftp.openpkg.org/release/2.2/UPD/sasl-2.1.19-2.2.1.src.rpm
    [5] ftp://ftp.openpkg.org/release/2.1/UPD/sasl-2.1.18-2.1.1.src.rpm
    [6] ftp://ftp.openpkg.org/release/2.2/UPD/
    [7] ftp://ftp.openpkg.org/release/2.1/UPD/
    [8] http://www.openpkg.org/security.html#signature


Primary Package Name:    sasl
Primary Package Home:    http://openpkg.org/go/package/sasl

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        2.1-SOLID         sasl-2.1.18-2.1.0
OpenPKG Community        2.2-SOLID         sasl-2.1.19-2.2.0
OpenPKG Community        CURRENT           sasl-2.1.19-20040920

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        2.1-SOLID         sasl-2.1.18-2.1.1
OpenPKG Community        2.2-SOLID         sasl-2.1.19-2.2.1
OpenPKG Community        CURRENT           sasl-2.1.20-20041025