CVE-2013-4122 — NULL Pointer Dereference in Cyrus-sasl2

CWE-189CWE-476 — NULL Pointer Dereference8 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
1.2%
top 21.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Cyrus-sasl2CMU Cyrus-sasl
Timeline
PublishedOct 27
Latest updateMay 17

Description

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶debiandebian/cyrus-sasl2< cyrus-sasl2 2.1.26.dfsg1-14 (bookworm)
▶NVDcmu/cyrus-sasl2.1.26+8

Patches

Patch: git.cyrusimap.org ↗Patch: git.cyrusimap.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-pwpx-m778-r79w: Cyrus SASL 2↗2022-05-17
▶
OSV
CVE-2013-4122: Cyrus SASL 2↗2013-10-27
▶

📋Vendor Advisories

4
Ubuntu
Cyrus SASL vulnerability↗2015-09-30
▶
Ubuntu
Cyrus SASL vulnerability↗2013-10-09
▶
Red Hat
cyrus-sasl: NULL pointer dereference (DoS) when glibc v.2.17 or FIPS-140 enabled Linux system used↗2013-07-12
▶
Debian
CVE-2013-4122: cyrus-sasl2 - Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL valu...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-4122 cyrus-sasl: NULL pointer dereference (DoS) when glibc v.2.17 or FIPS-140 enabled Linux system used↗2013-07-15
▶