[USN-1988-1] Cyrus SASL vulnerability

Marc Deslauriers marc.deslauriers at canonical.com
Wed Oct 9 17:09:45 UTC 2013

Ubuntu Security Notice USN-1988-1
October 09, 2013

cyrus-sasl2 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04


Cyrus SASL could be made to crash if it processed specially crafted input.

Software Description:
- cyrus-sasl2: Cyrus Simple Authentication and Security Layer


It was discovered that Cyrus SASL incorrectly handled certain invalid
password salts. An attacker could use this issue to cause Cyrus SASL to
crash, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  libsasl2-2                      2.1.25.dfsg1-6ubuntu0.1

After a standard system update you need to reboot your computer to make all
the necessary changes.


Package Information:

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131009/5269e961/attachment.sig>

More information about the ubuntu-security-announce mailing list