ZCS includes cyrus-sasl-2.1.21 which is not vulnerable:
http://asg.web.cmu.edu/archive/messa...-sasl&msg=7775 http://labs.musecurity.com/advisories/MU-200604-01.txt
Also we don't support the digest-md5 auth method.
Thanks for bringing this to our attention.