Out-of-bounds write in Cyrus SASL - CVE-2019-19906

Vulnerability identifier: #VU23796

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19906

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write error when processing LDAP queries within the _sasl_add_string() function in common.c file in cyrus-sasl. A remote non-authenticated attacker can create a specially LDAP request to the affected server, trigger off-by-one error in OpenLDAP implementation and crash the service.

Cyrus SASL
Red Hat OpenShift Serverless
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)
cyrus-sasl2 (Debian package)
cyrus-sasl2 (Ubuntu package)
cyrus-sasl (Alpine package)
cyrus-sasl-crammd5-32bit-debuginfo
cyrus-sasl-plain-debuginfo
cyrus-sasl-saslauthd
cyrus-sasl-saslauthd-debuginfo
cyrus-sasl-saslauthd-debugsource
cyrus-sasl-sqlauxprop
cyrus-sasl-sqlauxprop-debuginfo
libsasl2-3
libsasl2-3-debuginfo
cyrus-sasl-32bit
cyrus-sasl-32bit-debuginfo
cyrus-sasl-crammd5-32bit
cyrus-sasl-gssapi-debuginfo
cyrus-sasl-digestmd5-32bit
cyrus-sasl-digestmd5-32bit-debuginfo
cyrus-sasl-gssapi-32bit
cyrus-sasl-gssapi-32bit-debuginfo
cyrus-sasl-plain-32bit
cyrus-sasl-otp-debuginfo
libsasl2-3-32bit-debuginfo
libsasl2-3-32bit
cyrus-sasl-plain-32bit-debuginfo
cyrus-sasl
cyrus-sasl-crammd5
cyrus-sasl-crammd5-debuginfo
cyrus-sasl-debuginfo
cyrus-sasl-debugsource
cyrus-sasl-devel
cyrus-sasl-digestmd5
cyrus-sasl-digestmd5-debuginfo
cyrus-sasl-gssapi
cyrus-sasl-otp
cyrus-sasl-plain
cyrus-sasl (Red Hat package)
cyrus-sasl-ldap
cyrus-sasl-sql
cyrus-sasl-scram
cyrus-sasl-ntlm
cyrus-sasl-md5
cyrus-sasl-lib
cyrus-sasl-gs2
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Oracle Solaris
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Fedora
PowerStore T
Dell EMC VxRail Appliance

Install update from vendor's website.

Cyrus SASL - update to 2.1.28
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.11.0, 1.12.0
cyrus-sasl2 (Debian package) - addressed in versions 2.1.27+dfsg-1+deb10u1, 2.1.27~101-g0780600+dfsg-3+deb9u1
cyrus-sasl2 (Ubuntu package) - addressed in versions 2.1.26.dfsg1-14ubuntu0.2, 2.1.27+dfsg-1ubuntu0.1, 2.1.27~101-g0780600+dfsg-3ubuntu2.1
cyrus-sasl (Alpine package) - update to 2.1.26-r15
Quay - update to 3.3.3
cyrus-sasl-crammd5-32bit-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-plain-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-saslauthd - update to 2.1.26-150000.5.13.1
cyrus-sasl-saslauthd-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-saslauthd-debugsource - update to 2.1.26-150000.5.13.1
cyrus-sasl-sqlauxprop - update to 2.1.26-150000.5.13.1
cyrus-sasl-sqlauxprop-debuginfo - update to 2.1.26-150000.5.13.1
libsasl2-3 - update to 2.1.26-150000.5.13.1
libsasl2-3-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-32bit - update to 2.1.26-150000.5.13.1
cyrus-sasl-32bit-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-crammd5-32bit - update to 2.1.26-150000.5.13.1
cyrus-sasl-gssapi-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-digestmd5-32bit - update to 2.1.26-150000.5.13.1
cyrus-sasl-digestmd5-32bit-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-gssapi-32bit - update to 2.1.26-150000.5.13.1
cyrus-sasl-gssapi-32bit-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-plain-32bit - update to 2.1.26-150000.5.13.1
cyrus-sasl-otp-debuginfo - update to 2.1.26-150000.5.13.1
libsasl2-3-32bit-debuginfo - update to 2.1.26-150000.5.13.1
libsasl2-3-32bit - update to 2.1.26-150000.5.13.1
cyrus-sasl-plain-32bit-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl - update to 2.1.26-150000.5.13.1
cyrus-sasl-crammd5 - update to 2.1.26-150000.5.13.1
cyrus-sasl-crammd5-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-debugsource - update to 2.1.26-150000.5.13.1
cyrus-sasl-devel - update to 2.1.26-150000.5.13.1
cyrus-sasl-digestmd5 - update to 2.1.26-150000.5.13.1
cyrus-sasl-digestmd5-debuginfo - update to 2.1.26-150000.5.13.1
cyrus-sasl-gssapi - update to 2.1.26-150000.5.13.1
cyrus-sasl-otp - update to 2.1.26-150000.5.13.1
cyrus-sasl-plain - update to 2.1.26-150000.5.13.1
cyrus-sasl - addressed in versions 2.1.27-3.fc31, 2.1.27-4.fc32
cyrus-sasl (Red Hat package) - update to 2.1.27-5.el8
cyrus-sasl-ldap - update to 2.1.27-6
cyrus-sasl-sql - update to 2.1.27-6
cyrus-sasl-scram - update to 2.1.27-6
cyrus-sasl-plain - update to 2.1.27-6
cyrus-sasl-ntlm - update to 2.1.27-6
cyrus-sasl-md5 - update to 2.1.27-6
cyrus-sasl-lib - update to 2.1.27-6
cyrus-sasl-gssapi - update to 2.1.27-6
cyrus-sasl-gs2 - update to 2.1.27-6
cyrus-sasl-devel - update to 2.1.27-6
cyrus-sasl - update to 2.1.27-6
PowerStore T - update to 3.5.0.1-2083289
Dell EMC VxRail Appliance - update to 8.0.000

• https://github.com/cyrusimap/cyrus-sasl/issues/587
• https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html
• https://www.debian.org/security/2019/dsa-4591
• https://www.openldap.org/its/index.cgi/Incoming?id=9123

• Denial of service in Cyrus SASL
• Debian update for cyrus-sasl2
• Ubuntu update for Cyrus SASL
• Out-of-bounds write in cyrus-sasl (Alpine package)
• Red Hat Enterprise Linux 8 update for cyrus-sasl
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Quay
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Slackware Linux update for cyrus-sasl
• Multiple vulnerabilities in Oracle Solaris
• SUSE update for cyrus-sasl
• Multiple vulnerabilities in Dell VxRail Appliance components
• Multiple vulnerabilities in Dell PowerStore Family
• Anolis OS update for cyrus-sasl
• Fedora 32 update for cyrus-sasl
• Fedora 31 update for cyrus-sasl