CVE-2006-1721: cyrus sasl Improper Input Validation

CVSS: 2.6v2.0LowModified

AliasesRHSA-2007:0795RHSA-2007:0878DEBIAN-CVE-2006-1721+1 more

Published 11-04-2006Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2006-1721 is a low (CVSS 2.6) Improper Input Validation vulnerability in cyrus sasl. EPSS estimates a 2.49% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities.

Overall risk

11/100

0100

Low · default modelHow is this calculated?

CVSS score

2.6/10

010

Low · v2.0 (NVD)

EPSS score

2.49%

0%100%

Low · +0.06 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

11-04-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of service (segmentation fault) via malformed inputs in DIGEST-MD5 negotiation.

CVSS metrics

1 score · 1 source · 1 version

v2.02.6

EPSS trend

Probability

2.49%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

+0.06 pp

From 2.43% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Redhat8 products

cyrus-sasl< 0:2.1.19-14 | < 0:2.1.15-15
cyrus-sasl-debuginfo< 0:2.1.19-14 | < 0:2.1.15-15
cyrus-sasl-devel< 0:2.1.19-14 | < 0:2.1.15-15
cyrus-sasl-gssapi< 0:2.1.19-14 | < 0:2.1.15-15
cyrus-sasl-md5< 0:2.1.19-14 | < 0:2.1.15-15

Show all 8

Cyrus1 product

sasl2.1.18 | 2.1.18_r1 | 2.1.18_r2 | 2.1.19 | 2.1.20

Debian1 product

cyrus-sasl2< 2.1.19.dfsg1-0.2 | < 2.1.19-1.5sarge1

3 vendors · 10 products

References

50 links

secunia.com/advisories/26708Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/1744VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/19825Third Party AdvisoryX Refsource SECUNIAVendor Advisory
asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-sasl&msg=7775X Refsource CONFIRM
secunia.com/advisories/19809Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/19618Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
secunia.com/advisories/19753Third Party AdvisoryX Refsource SECUNIAVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9861VDB EntrySignatureX Refsource OVAL
exchange.xforce.ibmcloud.com/vulnerabilities/25738VDB EntryX Refsource XF
support.avaya.com/elmodocs2/security/ASA-2007-426.htmX Refsource CONFIRM

Show all 50 references

labs.musecurity.com/advisories/MU-200604-01.txtX Refsource MISCPatch
secunia.com/advisories/26857Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vmware.com/security/advisories/VMSA-2008-0009.htmlX Refsource CONFIRM
lists.grok.org.uk/pipermail/full-disclosure/2006-April/044992.htmlMailing ListX Refsource FULLDISC
secunia.com/advisories/22187Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:073Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2006/3852VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/27237Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2007-0878.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2007-0795.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/20014Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.apple.com/archives/security-announce/2006/Sep/msg00002.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/30535Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/17446VDB EntryX Refsource BIDPatch
secunia.com/advisories/19964Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/493080/100/0/threadedMailing ListX Refsource BUGTRAQ
www.trustix.org/errata/2006/0024Vendor AdvisoryX Refsource TRUSTIX
usn.ubuntu.com/272-1/Vendor AdvisoryX Refsource UBUNTU
www.novell.com/linux/security/advisories/2006_05_05.htmlVendor AdvisoryX Refsource SUSE
securitytracker.com/id?1016960VDB EntryX Refsource SECTRACK
www.gentoo.org/security/en/glsa/glsa-200604-09.xmlVendor AdvisoryX Refsource GENTOO
www.vupen.com/english/advisories/2006/1306VDB EntryX Refsource VUPENVendor Advisory
www.debian.org/security/2006/dsa-1042Vendor AdvisoryX Refsource DEBIAN
access.redhat.com/errata/RHSA-2007:0795Advisory
www.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=157012REPORT
bugzilla.redhat.com/show_bug.cgi?id=189814REPORT
bugzilla.redhat.com/show_bug.cgi?id=190113REPORT
bugzilla.redhat.com/show_bug.cgi?id=243910REPORT
bugzilla.redhat.com/show_bug.cgi?id=244075REPORT
bugzilla.redhat.com/show_bug.cgi?id=250732REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0795.jsonAdvisory
access.redhat.com/security/cve/CVE-2006-1721REPORT
www.cve.org/CVERecord?id=CVE-2006-1721Advisory
nvd.nist.gov/vuln/detail/CVE-2006-1721Advisory
access.redhat.com/errata/RHSA-2007:0878Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=252339REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0878.jsonAdvisory
security-tracker.debian.org/tracker/CVE-2006-1721Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities