CVE-2004-0884

CVE-2004-0884, security advisory, suse linux, suse, security, cve

CVE-2004-0884

Common Vulnerabilities and Exposures

[Previous] [Index] [Next]

Upstream information

CVE-2004-0884 at MITRE

Description

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	7.2
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
Access Vector	Local
Access Complexity	Low
Authentication	None
Confidentiality Impact	Complete
Integrity Impact	Complete
Availability Impact	Complete

SUSE Bugzilla entries: 61847 [RESOLVED / FIXED], 65901 [VERIFIED / FIXED], 66127 [RESOLVED / DUPLICATE]

SUSE Security Advisories:

• SUSE-SA:2004:037, published Wednesday, Oct 20th 2004 18:00 MEST

---

SUSE Timeline for this CVE

CVE page created: Fri Jun 28 00:59:19 2013
CVE page last modified: Fri Dec 8 16:10:14 2023