CVE-2013-4122

Exploit

EPSS 3.59%
Veröffentlicht 27.10.2013 00:55:03
Zuletzt bearbeitet 29.04.2026 01:13:23
Erkennungen
Login

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 12

NVD 9 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Cmu ≫ Cyrus-sasl Version <= 2.1.26

   Gnu ≫ Glibc Version 2.2
   Gnu ≫ Glibc Version 2.2.1
   Gnu ≫ Glibc Version 2.2.2
   Gnu ≫ Glibc Version 2.2.3
   Gnu ≫ Glibc Version 2.2.4
   Gnu ≫ Glibc Version 2.2.5
   Gnu ≫ Glibc Version 2.3
   Gnu ≫ Glibc Version 2.3.1
   Gnu ≫ Glibc Version 2.3.2
   Gnu ≫ Glibc Version 2.3.3
   Gnu ≫ Glibc Version 2.3.4
   Gnu ≫ Glibc Version 2.3.5
   Gnu ≫ Glibc Version 2.3.6
   Gnu ≫ Glibc Version 2.3.10
   Gnu ≫ Glibc Version 2.4
   Gnu ≫ Glibc Version 2.5
   Gnu ≫ Glibc Version 2.5.1
   Gnu ≫ Glibc Version 2.6
   Gnu ≫ Glibc Version 2.6.1
   Gnu ≫ Glibc Version 2.7
   Gnu ≫ Glibc Version 2.8
   Gnu ≫ Glibc Version 2.9
   Gnu ≫ Glibc Version 2.17
   Gnu ≫ Glibc Version 2.18

Cmu ≫ Cyrus-sasl Version 1.5.28

Cmu ≫ Cyrus-sasl Version 2.1.19

Cmu ≫ Cyrus-sasl Version 2.1.20

Cmu ≫ Cyrus-sasl Version 2.1.21

Cmu ≫ Cyrus-sasl Version 2.1.22

Cmu ≫ Cyrus-sasl Version 2.1.23

Cmu ≫ Cyrus-sasl Version 2.1.24

Cmu ≫ Cyrus-sasl Version 2.1.25

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	3.59%	0.879

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:N/A:P

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://git.cyrusimap.org/cyrus-sasl/commit/?id=dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d

Patch

Exploit

http://security.gentoo.org/glsa/glsa-201309-01.xml

http://www.debian.org/security/2015/dsa-3368

http://www.openwall.com/lists/oss-security/2013/07/12/3

http://www.openwall.com/lists/oss-security/2013/07/12/6

http://www.openwall.com/lists/oss-security/2013/07/13/1

http://www.openwall.com/lists/oss-security/2013/07/15/1

http://www.ubuntu.com/usn/USN-2755-1

https://www.linuxquestions.org/questions/slackware-14/%5Bslackware-current%5D-glibc-2-17-shadow-and-other-penumbrae-4175461061/

https://nvd.nist.gov/vuln/detail/CVE-2013-4122

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-4122

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-4122

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2013-4122