CVE-2005-0373

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-10-07 · updated 2026-06-16

Description

Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.

Affected products

macOS: 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.1 (+23)
Apple Mac Os X Server: 10.0, 10.1, 10.1.1, 10.1.2, 10.1.3, 10.1.4 (+19)
Conectiva Linux: 9.0, 10.0
Cyrus Sasl: 1.5.24, 1.5.27, 1.5.28, 2.1.9, 2.1.10, 2.1.11 (+8)
Openpkg: 2.1, 2.2
RedHat Fedora Core: core_1.0
Suse Cvsup: 16.1h_36.i586
Suse Linux: 1.0, 8.0, 8.1, 8.2, 9.0, 9.1 (+1)

References

http://www.gentoo.org/security/en/glsa/glsa-200410-05.xml
http://www.linuxcompatible.org/print42495.html
http://www.mandriva.com/security/advisories?name=MDKSA-2005:054
http://www.monkey.org/openbsd/archive/ports/0407/msg00265.html
http://www.securityfocus.com/bid/11347
https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c.diff?r1=1.170&r2=1.171
https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c?rev=1.171&content-type=text/x-cvsweb-markup
https://exchange.xforce.ibmcloud.com/vulnerabilities/17642
http://www.gentoo.org/security/en/glsa/glsa-200410-05.xml
http://www.linuxcompatible.org/print42495.html
http://www.mandriva.com/security/advisories?name=MDKSA-2005:054
http://www.monkey.org/openbsd/archive/ports/0407/msg00265.html

Get alerted when CVE-2005-0373 or the next vulnerability affects your stack