CVE-2009-0688: Buffer Overflow
Published May 15, 2009
·Updated
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the saslencode64 function in lib/saslutil.c.
Affected Software
46 affected components
Carnegie Mellon University Cyrus-sasl<=2.1.22
Carnegie Mellon University Cyrus-sasl=1.4.1
Carnegie Mellon University Cyrus-sasl=1.5.0
Carnegie Mellon University Cyrus-sasl=1.5.2
Carnegie Mellon University Cyrus-sasl=1.5.3
Carnegie Mellon University Cyrus-sasl=1.5.5
Carnegie Mellon University Cyrus-sasl=1.5.10
Carnegie Mellon University Cyrus-sasl=1.5.11
Carnegie Mellon University Cyrus-sasl=1.5.13
Carnegie Mellon University Cyrus-sasl=1.5.15
Carnegie Mellon University Cyrus-sasl=1.5.16
Carnegie Mellon University Cyrus-sasl=1.5.20
Carnegie Mellon University Cyrus-sasl=1.5.21
Carnegie Mellon University Cyrus-sasl=1.5.22
Carnegie Mellon University Cyrus-sasl=1.5.23
Carnegie Mellon University Cyrus-sasl=1.5.24
Carnegie Mellon University Cyrus-sasl=1.5.26
Carnegie Mellon University Cyrus-sasl=1.5.27
Carnegie Mellon University Cyrus-sasl=1.5.28
Carnegie Mellon University Cyrus-sasl=2.0.0
Carnegie Mellon University Cyrus-sasl=2.0.1
Carnegie Mellon University Cyrus-sasl=2.0.2
Carnegie Mellon University Cyrus-sasl=2.0.3
Carnegie Mellon University Cyrus-sasl=2.0.4
Carnegie Mellon University Cyrus-sasl=2.0.5
Carnegie Mellon University Cyrus-sasl=2.1.0
Carnegie Mellon University Cyrus-sasl=2.1.1
Carnegie Mellon University Cyrus-sasl=2.1.2
Carnegie Mellon University Cyrus-sasl=2.1.3
Carnegie Mellon University Cyrus-sasl=2.1.5
Carnegie Mellon University Cyrus-sasl=2.1.6
Carnegie Mellon University Cyrus-sasl=2.1.7
Carnegie Mellon University Cyrus-sasl=2.1.8
Carnegie Mellon University Cyrus-sasl=2.1.9
Carnegie Mellon University Cyrus-sasl=2.1.10
Carnegie Mellon University Cyrus-sasl=2.1.11
Carnegie Mellon University Cyrus-sasl=2.1.12
Carnegie Mellon University Cyrus-sasl=2.1.13
Carnegie Mellon University Cyrus-sasl=2.1.14
Carnegie Mellon University Cyrus-sasl=2.1.15
Carnegie Mellon University Cyrus-sasl=2.1.16
Carnegie Mellon University Cyrus-sasl=2.1.17
Carnegie Mellon University Cyrus-sasl=2.1.18
Carnegie Mellon University Cyrus-sasl=2.1.19
Carnegie Mellon University Cyrus-sasl=2.1.20
Carnegie Mellon University Cyrus-sasl=2.1.21
Remediation
Patch Available
Patch Available
Event History
May 15, 2009
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-0688?
CVE-2009-0688 has a high severity rating as it allows remote attackers to execute arbitrary code or cause a denial of service.
2
How do I fix CVE-2009-0688?
To fix CVE-2009-0688, upgrade the CMU Cyrus SASL library to version 2.1.23 or later.
3
Which versions of CMU Cyrus SASL are affected by CVE-2009-0688?
CVE-2009-0688 affects all versions of CMU Cyrus SASL prior to 2.1.23.
4
What kind of vulnerabilities does CVE-2009-0688 exploit?
CVE-2009-0688 exploits multiple buffer overflow vulnerabilities in the sasl_encode64 function.
5
Can CVE-2009-0688 lead to data breaches?
Yes, CVE-2009-0688 can potentially lead to data breaches due to the possibility of arbitrary code execution.