CVE-2013-4122: Null Pointer Dereference
Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4122?
CVE-2013-4122 has been classified as a High severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2013-4122?
To fix CVE-2013-4122, update Cyrus SASL to version 2.1.27 or later, where the vulnerability has been addressed.
Which versions of Cyrus SASL are affected by CVE-2013-4122?
CVE-2013-4122 affects Cyrus SASL versions 2.1.23 through 2.1.26 and also version 1.5.28.
What kind of attack does CVE-2013-4122 enable?
CVE-2013-4122 enables remote attackers to potentially cause a denial of service which results in thread crashes.
Is this vulnerability related to glibc implementations?
Yes, CVE-2013-4122 is related to the way glibc 2.17 and later handle NULL returns from the crypt function.