==========================================================================
Ubuntu Security Notice USN-4256-1
January 28, 2020

cyrus-sasl2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
– Ubuntu 14.04 ESM
– Ubuntu 12.04 ESM

Summary:

Cyrus SASL could be made to crash or execute arbitrary code if it received
a specially crafted LDAP packet.

Software Description:
– cyrus-sasl2: Cyrus Simple Authentication and Security Layer

Details:

It was discovered that Cyrus SASL incorrectly handled certain LDAP packets.
An attacker could possibly use this issue to execute arbitrary code or cause
a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
libsasl2-2 2.1.27+dfsg-1ubuntu0.1

Ubuntu 18.04 LTS:
libsasl2-2 2.1.27~101-g0780600+dfsg-3ubuntu2.1

Ubuntu 16.04 LTS:
libsasl2-2 2.1.26.dfsg1-14ubuntu0.2

Ubuntu 14.04 ESM:
libsasl2-2 2.1.25.dfsg1-17ubuntu0.1~esm1

Ubuntu 12.04 ESM:
libsasl2-2 2.1.25.dfsg1-3ubuntu0.2

After a standard system update you need to restart services using
SASL to effect the necessary changes.

References:
https://usn.ubuntu.com/4256-1
CVE-2019-19906

Package Information:
https://launchpad.net/ubuntu/+source/cyrus-sasl2/2.1.27+dfsg-1ubuntu0.1
https://launchpad.net/ubuntu/+source/cyrus-sasl2/2.1.27~101-g0780600+dfsg-3ubuntu2.1
https://launchpad.net/ubuntu/+source/cyrus-sasl2/2.1.26.dfsg1-14ubuntu0.2
—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAl4wPJoACgkQRbznW4QL
H2ksfxAArk/Ifev4/On88kveBhrdkYO9EmRJxb2kPpfek0Nvkr0IxshOfuzQFgLc
dvP+/BoKTPaSrtyfUUMB8Xe4j5SHJaEGJxVLU6xuwoveBwH6urZKHv6kj+rPeB/M
ygnFFuLpDTcnPkq6rpYZeKpxsAOAgFDt43RypNYGBfNjK1dIMtQ9a3JyBIOBrWwH
esF1i8mUjPgG8J3PMe6vZ5v14P3FxoACKWlDOPoXpGp+1TQ9dC6U8SklDbmWB0ZZ
2gs8HmZ2Eq33AXXgJUYzEEe2Sxu5hKYt9v7GB6m4SRP32efzTghdHQt4qwyGJs6R
xDsrgq22OcKtz6Cq0Cg6ap4W/15qjmB51PhQfYe64DsJjTVBCOaajNjVEkpNHr0g
yHEVXnteM+8G5xYZSf4+czJJ3zB7QXB3G522bq9XoNVsXGta4kdTM6jUbibXSK8k
CYiPClbWtqxp/P6OW55wcfbW09zY/6oQLgKtd/VIcFiIixDOLhFWZFvyFb/85v2S
BbEMD+Voy38t5PpQ8orIsBB03KOeh0FyR5sF8c6ABgRbf9q/8TeVOf0aUWdsMYu9
Sx5ymrsh8rW+NONSLK8WyRyHcNSO85mJbxcC/oVEtnVccx7k0w3a+VTuDttXCMDS
/88emDwI4uwecztd27juomCy45edcG6Ikq9BZ1oIgNNWzWe3kWg=
=xsKM
—–END PGP SIGNATURE—–
—