About:
The Cyrus SASL library is a generic library for easy integration of secure network authentication to any client or server application. It supports authentication via standard plaintext methods as well as CRAM-MD5 and DIGEST-MD5 shared secret methods and KERBEROS_V4 and GSSAPI Kerberos methods. The SASL protocol framework is used by SMTP, IMAP, ACAP, LDAP, and other standard protocols.

Release focus: Minor security fixes

Changes:
The most important fix is to avoid an attack using the SASL_PATH environment variable when sasl is used in a setuid environment (this is infrequent but possible). The CRAM MD5 plugin has a bugfix for an uninitialized variable reference. Also included are NTLM portability fixes.

Author:
Carnegie Mellon <cyrus __dash__ bugs+ __at__ andrew __dot__ cmu __dot__ edu> [contact developer]

Rating:	reset 1 2 3 4 5 6 7 8 9 10
8.26/10.00 (6 votes)

Homepage:
http://asg.web.cmu.edu/sasl/
Tar/GZ:
ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/

Trove categories: [change]

[Intended Audience]		Developers
[License]		OSI Approved :: BSD License (original)
[Topic]		Security, Software Development :: Libraries

Dependencies: [change]
OpenSSL (recommended)
[download links]

 Branches

Branch	Version	Last release	License	URLs
SASLv2	2.1.20	23-Nov-2004	BSD License (original)
SASLv1	1.5.28	16-Jul-2002	BSD License (original)

 Releases

Version	Focus	Date
2.1.20	Minor security fixes	23-Nov-2004 00:24
2.1.19	Minor bugfixes	14-Jul-2004 20:57
2.1.18	Minor bugfixes	11-Mar-2004 16:24
2.1.17	Minor bugfixes	01-Dec-2003 18:09
2.1.16-BETA	Major feature enhancements	15-Oct-2003 19:37
2.1.15	Minor bugfixes	15-Jul-2003 18:05
2.1.14	Minor feature enhancements	30-Jun-2003 18:19
2.1.13	Minor bugfixes	14-Apr-2003 23:10
2.1.12	Minor bugfixes	03-Feb-2003 21:49
2.1.11	Minor bugfixes	31-Jan-2003 23:30

 Articles referencing this project

Red Hat: Updated cyrus-sasl packages correct a security issue by Patrick Lenz , in Security Tue, Sep 11th 2007 02:43 Red Hat: Updated cyrus-sasl package addresses a security issue by Patrick Lenz , in Security Tue, Sep 11th 2007 02:40 Debian: New Cyrus SASL packages fix denial of service by Patrick Lenz , in Security Tue, Apr 25th 2006 11:58 Debian: New cyrus-sasl packages fix arbitrary code execution by Patrick Lenz , in Security Tue, Oct 12th 2004 08:08

Red Hat: Updated cyrus-sasl packages fix buffer overflows by Patrick Lenz , in Security Tue, Jan 7th 2003 05:00 Red Hat: Updated Cyrus-SASL packages available by Patrick Lenz , in Security Fri, Nov 30th 2001 02:06 SuSE: cyrus-sasl possible local/remote privilege escalation by Patrick Lenz , in Security Fri, Nov 23rd 2001 09:28