|
|
| |
|
| |
cyrus-sasl: denial of service
| Package(s): | cyrus-sasl |
CVE #(s): | CVE-2013-4122
|
| Created: | September 3, 2013 |
Updated: | September 5, 2013 |
| Description: |
From the Gentoo advisory:
In the GNU C Library (glibc) from version 2.17 onwards, the crypt()
function call can return NULL when the salt violates specifications or
the system is in FIPS-140 mode and a DES or MD5 hashed password is
passed. When Cyrus-SASL's authentication mechanisms call crypt(), a
NULL may be returned.
A remote attacker could trigger this vulnerability to cause a Denial of
Service condition. |
| Alerts: |
|
( Log in to post comments)
|
|
|