Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2004-0884

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

  • Published: Jan 27, 2005
  • Updated: Apr 13, 2023
  • CVE: CVE-2004-0884
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.2
  • AV:L/AC:L/Au:N/C:C/I:C/A:C

No CWE or OWASP classifications available.

Software From Fixed in
cyrus / sasl 2.1.16 2.1.16.x
cyrus / sasl 2.1.13 2.1.13.x
conectiva / linux 9.0 9.0.x
cyrus / sasl 2.1.18_r1 2.1.18_r1.x
cyrus / sasl 2.1.11 2.1.11.x
cyrus / sasl 1.5.24 1.5.24.x
cyrus / sasl 1.5.27 1.5.27.x
cyrus / sasl 2.1.14 2.1.14.x
cyrus / sasl 1.5.28 1.5.28.x
cyrus / sasl 2.1.18 2.1.18.x
cyrus / sasl 2.1.12 2.1.12.x
cyrus / sasl 2.1.17 2.1.17.x
conectiva / linux 10.0 10.0.x
cyrus / sasl 2.1.9 2.1.9.x
cyrus / sasl 2.1.10 2.1.10.x
cyrus / sasl 2.1.15 2.1.15.x