CVE-2019-19906 (NVD)

2019-12-19

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

Products Bookkeeper, Ipados, Iphone_os, Mac_os_x, Ubuntu_linux, Cyrus\-Sasl, Debian_linux, Fedora, Enterprise_linux, Enterprise_linux_eus, Enterprise_linux_for_ibm_z_systems, Enterprise_linux_for_ibm_z_systems_eus, Enterprise_linux_for_power_little_endian, Enterprise_linux_for_power_little_endian_eus, Enterprise_linux_server_aus, Enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions, Enterprise_linux_server_tus, Enterprise_linux_server_update_services_for_sap_solutions, Jboss_enterprise_web_server
Type Out-of-bounds Write (CWE-787)
Off-by-one Error (CWE-193)
First patch - None (likely due to unavailable code)
Patches https://github.com/cyrusimap/cyrus-sasl/issues/587
Links • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/
• https://seclists.org/bugtraq/2019/Dec/42
• https://support.apple.com/kb/HT211288
• http://seclists.org/fulldisclosure/2020/Jul/24
• http://seclists.org/fulldisclosure/2020/Jul/23