What is the CVSS score of CVE-2013-4122?

CVE-2013-4122 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. EPSS exploitation probability: 1.2%.

Is there a public PoC exploit available for CVE-2013-4122?

Yes, a public proof-of-concept exploit is available for CVE-2013-4122. Prioritise patching immediately. EPSS: 1.2%.

Cyrus Sasl CVE-2013-4122

MEDIUM

Numeric Errors (CWE-189)

2013-10-27 secalert@redhat.com

Denial Of Service Cyrus Sasl

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:N/I:N/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:N/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

None

Availability

Lifecycle Timeline

CVE Published

Oct 27, 2013 - 00:55 cve.org

MEDIUM 4.3

DescriptionCVE.org

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.

AnalysisAI

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-189. Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference. Affected products include: Cmu Cyrus-Sasl.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.