“Debian Security Advisory DSA-180-1 describes a buffer overflow vulnerability involving Cyrus SASL usernames.”

Package : cyrus-sasl Problem type : buffer overflow Debian-specific: no "A buffer overflow was found in cyrus-sasl2, the Cyrus SASL library. A remote attacker could exploit this vulnerability to crash the application using the library or potentially execute arbitrary code ... The overflow is triggered by a long user name."

DSA-180-1: cyrus-sasl -- buffer overflows. Marc Mutz discovered two buffer overflows in the Cyrus SASL library. In particular, the code for logging the client username and realm contained buffer overflows which could be exploited to gain access to the system under certain circumstances.

Description: "Buffer overflow in Cyrus SASL library (libsasl) allows remote attackers to execute arbitrary code via a long user name." This issue affects multiple platforms using Cyrus SASL and was addressed by various vendors including Debian in their security advisories.

Debian explains that "Debian Security Advisories (DSA) are published to announce security fixes for Debian stable releases" and that each DSA describes the package, vulnerability type and how to upgrade. Historical advisories (such as DSA-180-1) document vulnerabilities fixed in older releases but may no longer apply to current stable versions.

Carnegie Mellon University's Cyrus-SASL library is vulnerable to a buffer overflow, caused by improper bounds checking of usernames during canonicalization. A remote attacker could exploit this vulnerability by sending a long username to the vulnerable server, which could lead to arbitrary code execution. This vulnerability is tracked as CVE-2002-1347 and is addressed in multiple vendor advisories, including Debian's DSA-180-1 for cyrus-sasl.

The FAQ notes that older Debian Security Advisories remain online for historical reference but only apply to the Debian releases mentioned in the advisory. It clarifies that once a vulnerability is fixed via an advisory like DSA-180-1, the corrected packages are incorporated into subsequent stable releases.

SecurityFocus describes: "A buffer overflow condition has been discovered in Cyrus SASL. The problem occurs when processing user names of excessive length. A remote attacker may exploit this issue by supplying a maliciously long user name string, potentially resulting in the execution of arbitrary attacker-supplied code." It notes that various vendors (including Debian) released updates to correct the flaw.

DSA-180-1 cyrus-sasl -- buffer overflows. Marc Mutz discovered two buffer overflows in the Cyrus SASL library. The affected code is used when logging the client username and realm, which may be overflowed by overly long values, leading to potential exploitation.

LWN reports: "A remotely exploitable buffer overflow has been found in the Cyrus SASL library. The overflow occurs in the code that processes usernames; an overly long username string can overwrite memory and may allow remote code execution." It notes that multiple distributions, including Debian, issued security advisories and updated packages.

Debian Security Advisory DSA-180-1 reports: 'cyrus-sasl -- buffer overflows'. Marc Mutz discovered two buffer overflows in the Cyrus SASL library, in the part of the code that logs the client username and realm. Overly long username or realm values could trigger these overflows and may be exploited.

A vulnerability has been reported in the Cyrus SASL library that may allow remote attackers to cause a denial of service or execute arbitrary code. The issue occurs because the library does not adequately handle overly long usernames supplied during the authentication process, leading to a buffer overflow condition.

From the advisory: 'Marc Mutz discovered two buffer overflows in the Cyrus SASL library. The code for logging the client username and realm contained buffer overflows which could be exploited to gain access to the system under certain circumstances.' The advisory provides updated cyrus-sasl packages for Debian.

Several buffer overflow vulnerabilities have been reported for Cyrus SASL. The issues exist in the username prompt handling code. A remote attacker could exploit these issues by sending a specially crafted username, which may lead to execution of arbitrary code.

Cyrus SASL is reported prone to a buffer overflow condition when canonicalizing usernames. Reportedly, this issue may be exploited by an attacker to execute arbitrary code with the privileges of the Cyrus SASL library process. This vulnerability has been assigned CVE-2002-1347 and is referenced by various vendor advisories, including Debian DSA-180-1.

Debian Security Advisories (DSA) are used to announce vulnerabilities in packages distributed with Debian. Each advisory identifies the affected package, the nature of the vulnerability (such as buffer overflows, privilege escalations, etc.), and the potential impact on users.

Description: Multiple buffer overflows in cyrus-sasl library, including in the function handling username prompts, as reported by Joost Pol. Security impact: remote root possible for services using the affected library.

This bug tracks the issue where Cyrus SASL crashes or behaves unexpectedly when presented with exceptionally long usernames. Investigation showed a buffer overflow in the plaintext authentication code path that is triggered by such usernames.

A vulnerability exists in Cyrus SASL in which a long username passed to the plaintext authentication mechanism overflows an internal buffer. Remote users may exploit this by sending an overly long username during login, causing a crash or potentially executing code.

Historical security records show that Debian Security Advisory DSA-180-1 was issued in 2002 for the cyrus-sasl package and specifically referenced a buffer overflow triggered by overly long SASL usernames. The advisory aligned with CVE-2002-0040, which describes a remote buffer overflow in the Cyrus SASL library when processing long usernames.

A post discussing historical Cyrus SASL flaws mentions CVE-2002-0040 and notes that it was "an early 2000s buffer overflow in libsasl related to username handling" that had long since been fixed by vendors. The message treats the association between that flaw and vendor advisories such as Debian’s as established history and does not challenge their descriptions.

The report states: 'Description: Cyrus SASL 2.1.9 has buffer overflow and misc bugs. See: http://online.securityfocus.com/archive/1/302603.' It further notes that the referenced discussion describes buffer overflows in the Cyrus SASL library, including issues in handling user-related data, and that other vendors such as Debian have released advisories.

The report lists: 'Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities.' It notes that outdated Cyrus SASL installations are affected by buffer overflow issues that can be triggered via authentication inputs.

Discussion thread referencing historical advisories such as Debian DSA-180-1 for Cyrus SASL buffer overflows in username prompt code. Participants note that these issues were fixed years ago and relate to legacy versions of the library.

This security advisory describes a SASL DIGEST-MD5 buffer overflow in libcurl when using POP3, SMTP or IMAP. It explains that data from the server is appended to a fixed-size buffer without proper length checks. The issue is unrelated to Cyrus SASL or to Debian Security Advisory DSA-180-1, but illustrates another SASL-related buffer overflow in a different software component.

The release notes for Cyrus SASL 2.1.x list security-related fixes such as: 'Fixed potential buffer overflow in saslautd_verify_password().' and 'Added additional checks for buffer lengths.' While these notes confirm that Cyrus SASL had buffer overflow issues that were later corrected, they do not explicitly mention Debian Security Advisory DSA-180-1 or describe the specific username logging overflow that DSA-180-1 addresses.

A user reports a suspected buffer overflow in cyrus-sasl when compiled with certain options, describing stack protector warnings and crashes. This modern GitHub issue concerns a different potential overflow in Cyrus SASL and does not relate specifically to the historical Debian DSA-180-1 advisory about username logging buffer overflows.