MongoDB C Driver Heap Buffer Overflow Vulnerability in SASL Integration

A heap buffer overflow vulnerability has been identified in the MongoDB C Driver's integration with Cyrus SASL. This issue arises from unsafe string copying during the canonicalization of usernames. The vulnerability can be exploited by providing untrusted input in the username field of a MongoDB URI that includes the GSSAPI authentication mechanism. The buffer overflow occurs before any authentication is performed or network traffic is transmitted.

Impact

Exploitation of this vulnerability leads to a heap buffer overflow, which can potentially be exploited to execute arbitrary code.

Reproduction

To reproduce this vulnerability, create a MongoDB URI that includes the GSSAPI authentication mechanism. Insert an overly long or specially crafted username that exploits the unsafe string copying during canonicalization. When the URI is processed by the MongoDB C Driver, the buffer overflow will occur.

Remediation

Users can upgrade to MongoDB C Driver versions 2.2.0 or 2.1.3, where this vulnerability has been fixed.