RHBA-2014:1570 - Bug Fix Advisory

Topic

Updated cyrus-sasl packages that fix two bugs and add one enhancement are now
available for Red Hat Enterprise Linux 6.

Description

The cyrus-sasl packages contain the Cyrus implementation of Simple
Authentication and Security Layer (SASL). SASL is a method for adding
authentication support to connection-based protocols.

This update fixes the following bugs:

• A memory leak in the Digest MD5 plugin was discovered. Specifically, the

make_client_response() function did not correctly free the output buffer.
Consequently, applications that used Digest MD5 with very large datasets could
terminate unexpectedly. This update corrects make_client_response() and closes
the memory leak. As a result, applications using Digest MD5 as part of
authentication with large datasets now work as expected. (BZ#838628)

• Previously, unnecessary quote characters were used in the cyrus-sasl.spec file

when the user was created using the useradd command. Consequently, the Saslauth
user was created with quotes in the comment field ("Saslauthd user"). With this
update, unnecessary quotes have been removed from the comment field.
(BZ#1081445)

In addition, this update adds the following enhancement:

• The ad_compat option has been backported to the cyrus-sasl packages from

upstream. This option controls compatibility with AD or similar servers that
require both integrity and confidentiality bits selected during security layer
negotiation.
(BZ#994242)

Users of cyrus-sasl are advised to upgrade to these updated packages, which fix
these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 994242 - backport the ad_compat option

CVEs

(none)

References

(none)