Summary
The remote host is missing an update to cyrus-sasl2 announced via advisory USN-790-1.
Solution
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 6.06 LTS:
libsasl2 2.1.19.dfsg1-0.1ubuntu3.1
Ubuntu 8.04 LTS:
libsasl2-2 2.1.22.dfsg1-18ubuntu2.1
Ubuntu 8.10:
libsasl2-2 2.1.22.dfsg1-21ubuntu2.1
Ubuntu 9.04:
libsasl2-2 2.1.22.dfsg1-23ubuntu3.1
After a standard system upgrade you need to restart services using SASL to effect the necessary changes.
https://secure1.securityspace.com/smysecure/catid.html?in=USN-790-1
Insight
James Ralston discovered that the Cyrus SASL base64 encoding function could be used unsafely. If a remote attacker sent a specially crafted request to a service that used SASL, it could lead to a loss of privacy, or crash the application, resulting in a denial of service.
Severity
Classification
-
CVE CVE-2009-0688 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities