CVEvulnerability

CVE-2004-0884

7.2 HIGH Published 2005-01-27 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-01-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Affected configurations

• cyrus sasl 1.5.24 • cyrus sasl 1.5.27 • cyrus sasl 1.5.28 • cyrus sasl 2.1.9 • cyrus sasl 2.1.10 • cyrus sasl 2.1.11 • cyrus sasl 2.1.12 • cyrus sasl 2.1.13 • cyrus sasl 2.1.14 • cyrus sasl 2.1.15 • cyrus sasl 2.1.16 • cyrus sasl 2.1.17 • cyrus sasl 2.1.18 • cyrus sasl 2.1.18 r1 • conectiva linux 9.0 • conectiva linux 10.0

References