Vulnerability Details : CVE-2002-1347
Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.
Vulnerability category: Execute codeDenial of service
Products affected by CVE-2002-1347
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:cyrusimap:cyrus_sasl:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2002-1347
9.98%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2002-1347
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | 2024-02-02 |
CWE ids for CVE-2002-1347
-
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.Assigned by: nvd@nist.gov (Primary)
References for CVE-2002-1347
-
http://www.securityfocus.com/bid/6348
Broken Link;Third Party Advisory;VDB Entry
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/10810
Cyrus-SASL library username buffer overflow CVE-2002-1347 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html
Mailing List
-
http://www.redhat.com/support/errata/RHSA-2002-283.html
SupportBroken Link
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/10812
Cyrus-SASL library log writer buffer overflow CVE-2002-1347 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/6347
Broken Link;Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/advisories/4826
Broken Link;Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/6349
Broken Link;Third Party Advisory;VDB Entry
-
http://archives.neohapsis.com/archives/linux/suse/2002-q4/1275.html
Broken Link
-
http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557
Broken Link
-
http://marc.info/?l=bugtraq&m=103946297703402&w=2
'Cyrus SASL library buffer overflows' - MARCMailing List;Patch
-
http://www.debian.org/security/2002/dsa-215
Debian -- The Universal Operating SystemBroken Link
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/10811
Cyrus-SASL library saslauthd daemon escape character buffer overflow CVE-2002-1347 Vulnerability ReportThird Party Advisory;VDB Entry
Jump to