CVE-2002-1347

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-131

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 18, 2002
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2002

CVE-2002-13485.0w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access filesCVE-2002-13494.6Buffer overflow in pop3trap.exe for PC-cillin 2000, 2002, and 2003 allows local users to execute arbitrary code via a long input string to TCVE-2002-13507.5The BGP decoding routines in tcpdump 3.6.x before 3.7 do not properly copy data, which allows remote attackers to cause a denial of service CVE-2002-13515.0Buffer overflow in Melange Chat System 1.10 allows remote attackers to cause a denial of service (chat server crash) and possibly execute arCVE-2002-13525.0Per Magne Knutsen's CartMan shopping cart (cartman.php) 1.04 and earlier allows remote attackers to modify product prices by changing the prCVE-2002-13535.0LocalWEB2000 HTTP server 2.1.0 stores passwords in plain text under the web document root in users.lst, which allows remote attackers to obtCVE-2002-13545.0Directory traversal vulnerability in TYPSoft FTP Server 0.99.8 allows local users to list the contents of arbitrary directories via a ... (dCVE-2002-13555.0Multiple integer signedness errors in the BGP dissector in Ethereal 0.9.7 and earlier allow remote attackers to cause a denial of service (iCVE-2002-13567.5Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed paCVE-2002-135710.0Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote aCVE-2002-135810.0Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a dCVE-2002-135910.0Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial o
CVE-2002-1347: Critical severity, CVSS 9.8 | Vulnix