AI_ONLY_REPORT
package: cyrus-sasl-2.1.28-29.el10
------
Summary: Heap buffer overflow in add_to_challenge() when quoting increases value length: A malicious server or peer can trigger a client-side heap overflow in Cyrus SASL during DIGEST-MD5 or HTTP Digest authentication by sending challenge fields with many escapable characters so the quoted value grows beyond the size calculated before allocation.
Requirements to exploit: The attacker must control a malicious server or peer that a Cyrus SASL client authenticates to using DIGEST-MD5 or HTTP Digest. They must supply a challenge containing a field that is later re-emitted with `need_quotes=TRUE` (for example `nonce` or `opaque`) and many escapable characters. This is a client-side issue during challenge handling, not the reverse server-side direction.
Component affected: cyrus-sasl (`plugins/digestmd5.c`, client-side `add_to_challenge()` used by DIGEST-MD5/HTTP Digest response generation)
Version affected: cyrus-sasl-2.1.28-29.el10 (confirmed); the vulnerable logic likely predates this package version, but earlier affected versions were not confirmed here.
Patch available: no
Version fixed (if any already): unknown
Upstream coordination: Not yet notified. This report is the initial triage.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - 8.8 (HIGH)
AV:N - The issue is triggered by attacker-controlled challenge data received over a network authentication exchange.
AC:L - No race or unusual conditions are required beyond use of the affected DIGEST-MD5 or HTTP Digest client path.
PR:N - The attacker needs no prior privileges on the victim system.
UI:R - A victim must initiate or complete authentication with the malicious server or peer.
S:U - The overflow occurs within the client process that constructs the response.
C:H - Reasonable worst-case impact for exploitable heap corruption is disclosure of client-accessible data.
I:H - Reasonable worst-case impact for exploitable heap corruption is modification or code execution in the client context.
A:H - Heap corruption can crash the client and may permit broader process compromise.
Impact: Likely Important. This is a client-side memory-safety flaw reachable from attacker-controlled network input during DIGEST-MD5 or HTTP Digest authentication. A malicious server or peer can at least crash a vulnerable client, and reasonable worst-case impact includes stronger compromise in the client context if the overflow is exploitable. The need for the victim to authenticate to the malicious peer keeps this below Critical.
Embargo: yes
Reason: No upstream fix is known yet, and public disclosure before a fix is available would expose clients that still use DIGEST-MD5 or HTTP Digest to malicious servers or peers.
Acknowledgement: Aisle Research
Steps to reproduce:
1. Build cyrus-sasl with AddressSanitizer or another memory sanitizer.
2. Exercise the client-side DIGEST-MD5 or HTTP Digest code path so execution reaches `make_client_response()` / `add_to_challenge()`.
3. From a malicious server or peer, send a challenge containing a field that will be re-emitted with `need_quotes=TRUE` (for example `nonce` or `opaque`) and many escapable characters such as repeated `\"` and `
`.
4. Trigger response generation by allowing the client to continue the authentication exchange.
5. Observe a heap-buffer-overflow at `strcat(*str, quoted)` in `add_to_challenge()` under the sanitizer.
Mitigation:
Avoid or disable DIGEST-MD5 and HTTP Digest when authenticating to untrusted servers or peers until a fix is available.

Prefer alternative authentication mechanisms that do not use this code path where feasible.

Apply an upstream or vendor fix once available.




Vulnerability Details






`add_to_challenge()` computes `newlen` from the unquoted input length. When escaping is needed for `"` or `\`, `quote()` returns a longer string. The code updates `valuesize` after quoting, but reuses the stale pre-quote `newlen` when calling `_plug_buf_alloc()`, then appends the expanded string with `strcat()`:
```c
valuesize = strlen((char *) value);
newlen = (unsigned) (*curlen + 1 + namesize + 2 + valuesize + 2);
...
valuesize = strlen(quoted);
ret = _plug_buf_alloc(utils, str, buflen, newlen);
if (ret == SASL_OK) {
strcat(*str, quoted);
}
```
Because `_plug_buf_alloc()` only guarantees the requested size, a buffer that was exactly sized for the unquoted value can overflow when the quoted value becomes longer.
Most relevant CWE IDs:
`CWE-131` Incorrect Calculation of Buffer Size

`CWE-122` Heap-Based Buffer Overflow

`CWE-787` Out-of-Bounds Write




Proposed Fix






Recompute `newlen` after quoting based on the current output length plus the expanded quoted value length, allocate using that recomputed size, and update `*curlen` from the actual resulting string length instead of reusing the stale pre-quote size.
------
This report was generated using AI technology. Always review AI-generated content prior to use