NetSight
IP …
high7.2

CVE-2004-0884

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which…

Impact

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Affected products

VendorProductAffected versions
CyrusSasl
Versions 1.5.24, 1.5.27, 1.5.28, 2.1.9, 2.1.10, 2.1.11
ConectivaLinux
Versions 9.0, 10.0

References