FKIE_CVE-2006-1721

Vulnerability from fkie_nvd - Published: 2006-04-11 23:02 - Updated: 2026-06-16 22:23
Severity
Summary
digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of service (segmentation fault) via malformed inputs in DIGEST-MD5 negotiation.
References
cve@mitre.orgftp://patches.sgi.com/support/free/security/advisories/20070901-01-P.asc
cve@mitre.orghttp://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-sasl&msg=7775
cve@mitre.orghttp://labs.musecurity.com/advisories/MU-200604-01.txtPatch
cve@mitre.orghttp://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html
cve@mitre.orghttp://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044992.html
cve@mitre.orghttp://secunia.com/advisories/19618Patch, Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/19753Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/19809Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/19825Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/19964Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/20014Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/22187Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/26708Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/26857Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/27237Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/30535Vendor Advisory
cve@mitre.orghttp://securitytracker.com/id?1016960
cve@mitre.orghttp://support.avaya.com/elmodocs2/security/ASA-2007-426.htm
cve@mitre.orghttp://www.debian.org/security/2006/dsa-1042
cve@mitre.orghttp://www.gentoo.org/security/en/glsa/glsa-200604-09.xml
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2006:073
cve@mitre.orghttp://www.novell.com/linux/security/advisories/2006_05_05.html
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2007-0795.html
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2007-0878.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/493080/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/17446Patch
cve@mitre.orghttp://www.trustix.org/errata/2006/0024
cve@mitre.orghttp://www.vmware.com/security/advisories/VMSA-2008-0009.html
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/1306Vendor Advisory
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/3852Vendor Advisory
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/1744Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/25738
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9861
cve@mitre.orghttps://usn.ubuntu.com/272-1/
af854a3a-2127-422b-91ae-364da2661108ftp://patches.sgi.com/support/free/security/advisories/20070901-01-P.asc
af854a3a-2127-422b-91ae-364da2661108http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-sasl&msg=7775
af854a3a-2127-422b-91ae-364da2661108http://labs.musecurity.com/advisories/MU-200604-01.txtPatch
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html
af854a3a-2127-422b-91ae-364da2661108http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044992.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19618Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19753Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19809Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19825Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19964Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20014Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/22187Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26708Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26857Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27237Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/30535Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1016960
af854a3a-2127-422b-91ae-364da2661108http://support.avaya.com/elmodocs2/security/ASA-2007-426.htm
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2006/dsa-1042
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-200604-09.xml
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2006:073
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/linux/security/advisories/2006_05_05.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2007-0795.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2007-0878.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/493080/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/17446Patch
af854a3a-2127-422b-91ae-364da2661108http://www.trustix.org/errata/2006/0024
af854a3a-2127-422b-91ae-364da2661108http://www.vmware.com/security/advisories/VMSA-2008-0009.html
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/1306Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/3852Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/1744Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/25738
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9861
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/272-1/
Impacted products
Vendor Product Version
cyrus sasl 2.1.18
cyrus sasl 2.1.18_r1
cyrus sasl 2.1.18_r2
cyrus sasl 2.1.19
cyrus sasl 2.1.20
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cyrus:sasl:2.1.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "798B1672-529E-4D61-9CE6-A3C362AA3FD7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cyrus:sasl:2.1.18_r1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD156C94-966C-4EF7-A386-DA5516B77DD2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cyrus:sasl:2.1.18_r2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0796A70B-0DA4-4E85-8E34-1A063B382CF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cyrus:sasl:2.1.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CCB8D42-FA2B-4566-8884-5C5523B19392",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cyrus:sasl:2.1.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0B11541-A371-4B2C-9CBF-FA57553D4ACF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of service (segmentation fault) via malformed inputs in DIGEST-MD5 negotiation."
    }
  ],
  "id": "CVE-2006-1721",
  "lastModified": "2026-06-16T22:23:30.303",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 2.6,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-04-11T23:02:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20070901-01-P.asc"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-sasl\u0026msg=7775"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://labs.musecurity.com/advisories/MU-200604-01.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044992.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19618"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19753"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19809"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19825"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19964"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/20014"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/22187"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26708"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26857"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/27237"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/30535"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1016960"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-426.htm"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2006/dsa-1042"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200604-09.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:073"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2006_05_05.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0795.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0878.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/493080/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/17446"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.trustix.org/errata/2006/0024"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vmware.com/security/advisories/VMSA-2008-0009.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/1306"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/3852"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2008/1744"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25738"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9861"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://usn.ubuntu.com/272-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20070901-01-P.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-sasl\u0026msg=7775"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://labs.musecurity.com/advisories/MU-200604-01.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044992.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19618"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19753"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19809"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19825"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/19964"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/20014"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/22187"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26708"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26857"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/27237"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/30535"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1016960"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-426.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2006/dsa-1042"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200604-09.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:073"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2006_05_05.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0795.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0878.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/493080/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/17446"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.trustix.org/errata/2006/0024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vmware.com/security/advisories/VMSA-2008-0009.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/1306"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/3852"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2008/1744"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25738"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9861"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://usn.ubuntu.com/272-1/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.