RHSA-2007:0795 - Security Advisory

Topic

An updated cyrus-sasl package that addresses a security issue and fixes
various other bugs is now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The cyrus-sasl package contains the Cyrus implementation of SASL. SASL is
the Simple Authentication and Security Layer, a method for adding
authentication support to connection-based protocols.

A bug was found in cyrus-sasl's DIGEST-MD5 authentication mechanism. As
part of the DIGEST-MD5 authentication exchange, the client is expected to
send a specific set of information to the server. If one of these items
(the "realm") was not sent or was malformed, it was possible for a remote
unauthenticated attacker to cause a denial of service (segmentation fault)
on the server. (CVE-2006-1721)

This errata also fixes the following bugs:

• the Kerberos 5 library included in Red Hat Enterprise Linux 4 was not

thread safe. This update adds functionality which allows it to be used
safely in a threaded application.

• several memory leak bugs were fixed in cyrus-sasl's DIGEST-MD5

authentication plug-in.

• /dev/urandom is now used by default on systems which don't support

hwrandom. Previously, dev/random was the default.

• cyrus-sasl needs zlib-devel to build properly. This dependency

information is now included in the package.

Users are advised to upgrade to this updated cyrus-sasl package, which
resolves these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.5 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5 ppc

Fixes

• BZ - 157012 - [RFE] cyrus-sasl should use /dev/urandom by default
• BZ - 189814 - CVE-2006-1721 cyrus-sasl digest-md5 DoS
• BZ - 190113 - Missing build dependancy for zlib-devel in cyrus-sasl
• BZ - 243910 - krb5-libs are not thread-safe
• BZ - 244075 - Memory leaks in digest-md5 plugin
• BZ - 250732 - sasl-sample-server crash

CVEs

• CVE-2006-1721

References

• http://www.redhat.com/security/updates/classification/#moderate