ALAS-2014-338


Amazon Linux 1 Security Advisory: ALAS-2014-338
Advisory Release Date: 2014-05-13 16:37 Pacific
Advisory Updated Date: 2014-09-18 00:34 Pacific
Severity: Medium

Issue Overview:

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.


Affected Packages:

cyrus-sasl


Issue Correction:
Run yum update cyrus-sasl to update your system.

New Packages:
i686:
    cyrus-sasl-ldap-2.1.23-13.14.amzn1.i686
    cyrus-sasl-ntlm-2.1.23-13.14.amzn1.i686
    cyrus-sasl-debuginfo-2.1.23-13.14.amzn1.i686
    cyrus-sasl-sql-2.1.23-13.14.amzn1.i686
    cyrus-sasl-lib-2.1.23-13.14.amzn1.i686
    cyrus-sasl-plain-2.1.23-13.14.amzn1.i686
    cyrus-sasl-devel-2.1.23-13.14.amzn1.i686
    cyrus-sasl-gssapi-2.1.23-13.14.amzn1.i686
    cyrus-sasl-2.1.23-13.14.amzn1.i686
    cyrus-sasl-md5-2.1.23-13.14.amzn1.i686

src:
    cyrus-sasl-2.1.23-13.14.amzn1.src

x86_64:
    cyrus-sasl-ntlm-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-ldap-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-debuginfo-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-sql-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-devel-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-lib-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-plain-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-gssapi-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-md5-2.1.23-13.14.amzn1.x86_64
    cyrus-sasl-2.1.23-13.14.amzn1.x86_64