cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688

This appears to be patched in debian lenny, version 2.1.22.dfsg1-23+lenny1

Some additional details from one of our security engineers:

The Cyrus SASL function The sasl_encode64() function converts a string into base64. The Cyrus SASL library contains buffer overflows that occur because of unsafe use of the sasl_encode64() function.

Cyrus SASL 2.1.23 has been released to address this issue, however, Cyrus released this warning:

While this patch will fix currently vulnerable code, it can cause non-vulnerable existing code to break. Here's a function prototype from include/saslutil.h to clarify my explanation:
/* base64 encode
* in -- input data
* inlen -- input data length
* out -- output buffer (will be NUL terminated)
* outmax -- max size of output buffer
* result:
* outlen -- gets actual length of output buffer (optional)
*
* Returns SASL_OK on success, SASL_BUFOVER if result won't fit
*/
LIBSASL_API int sasl_encode64(const char *in, unsigned inlen,
char *out, unsigned outmax,
unsigned *outlen);

Assume a scenario where calling code has been written in such a way that it calculates the exact size required for base64 encoding in advance, then allocates a buffer of that exact size, passing a pointer to the
buffer into sasl_encode64() as *out. As long as this code does not anticipate that the buffer is NUL-terminated (does not call any string-handling functions like strlen(), for example) the code will work and it will not be vulnerable.

Once this patch is applied, that same code will break because sasl_encode64() will begin to return SASL_BUFOVER.

Thank you for using Ubuntu and taking the time to report a bug. Unfortunately, the upstream changes may break existing applications, so all applications using cyrus-sasl need to be verified to not break or patched.

This has been fixed in karmic with the merge of cyrus-sasl2 2.1.23.dfsg-1ubuntu1.

Is there an ETA for Hardy?

Verified that programs in main are not affected by the ABI change:
  mutt
  postfix
  sendmail

Programs in universe may need additional review:
  beepcore-c
  cyrus21-imapd
  cyrus-imapd-2.2
  cyrus-sasl2-heimdal
  cyrus-sasl2-mit
  hotway
  inn2
  kolab-cyrus-imapd
  libetpan
  mail-notification
  nmh
  nufw
  pexts
  zmailer

Published: http://www.ubuntu.com/usn/usn-790-1