The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2004-10-21T04:00:00
Updated: 2024-08-08T00:31:47.620Z
Reserved: 2004-09-22T00:00:00
Link: CVE-2004-0884
Vulnrichment
No data.
NVD
Status : Modified
Published: 2005-01-27T05:00:00.000
Modified: 2024-11-20T23:49:36.267
Link: CVE-2004-0884
Redhat