Ubuntu Security Notices
USN-4256-1

USN-4256-1: Cyrus SASL vulnerability

Publication date

28 January 2020

Overview

Cyrus SASL could be made to crash or execute arbitrary code if it received a specially crafted LDAP packet.

Releases

19.10 18.04 LTS 16.04 LTS 14.04 LTS 12.04

Packages

cyrus-sasl2 - Cyrus Simple Authentication and Security Layer

Details

It was discovered that Cyrus SASL incorrectly handled certain LDAP packets.
An attacker could possibly use this issue to execute arbitrary code or cause
a denial of service.

Update instructions

After a standard system update you need to restart services using SASL to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
19.10 eoan	libsasl2-2 – 2.1.27+dfsg-1ubuntu0.1
18.04 bionic	libsasl2-2 – 2.1.27~101-g0780600+dfsg-3ubuntu2.1
16.04 xenial	libsasl2-2 – 2.1.26.dfsg1-14ubuntu0.2
14.04 trusty	libsasl2-2 – 2.1.25.dfsg1-17ubuntu0.1~esm1
12.04 precise	libsasl2-2 – 2.1.25.dfsg1-3ubuntu0.2

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2019-19906

CVE-2019-19906