CVSS: 5.8EPSS: 3%CPEs: 9EXPL: 0CVE-2009-0844 – krb5: buffer over-read in SPNEGO GSS-API mechanism (MITKRB5-SA-2009-001)
https://notcve.org/view.php?id=CVE-2009-0844
The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read. La función get_input_token en la implementación SPNEGO de MIT Kerberos 5 (también conocido como krb5) v1.5 hasta v1.6.3 permite a atacantes remotos provocar una denegación de servicio (caída del demonio) y posiblemente obtener información sensible a través de un valor length modificado que dispara una sobrescritura del búfer. • http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://secunia.com/advisories/34594 http://secunia.com/advisories/34617 http://secunia.com/advisories/34622 http://secunia.com/advisories/34628 http://secunia.com/advisories/34630 http://secunia.com/advisories/34637 http://secunia.com/advisories/34640 http://secunia.com/advisories/34734 http://secunia.com/advisories/35074 http://security.gentoo.org/glsa/glsa-200904-09.xml http://sunsolve.sun.com/search • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 5%CPEs: 8EXPL: 1CVE-2009-0845 – krb5: NULL pointer dereference in GSSAPI SPNEGO (MITKRB5-SA-2009-001)
https://notcve.org/view.php?id=CVE-2009-0845
The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token. La función spnego_gss_accept_sec_context en lib/gssapi/spnego/spnego_mech.c en MIT Kerberos 5 (conocido como krb5) v.1.6.3, cuando se utiliza SPNEGO, permite a atacantes remotos provocar una denegación de servicio (referencia a puntero nulo y caída de la aplicación) mediante datos "ContextFlags" inválidos en el campo "reqFlags" en el token negTokenInit. • http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=6402 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://secunia.com/advisories/34347 http://secunia.com/advisories/34594 http://secunia.com/advisories/34617 http://secunia.com/advisories/34622 http://secunia.com/advisories/34628 http://secunia.com/advisories/34630 http://secunia.com/advisories/34637 http://secunia.com/advisories/34640 http://secunia.com/advisories/34734 http:&#x • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 64%CPEs: 9EXPL: 0CVE-2008-0062 – krb5: uninitialized pointer use in krb5kdc
https://notcve.org/view.php?id=CVE-2008-0062
KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free. KDC en MIT Kerberos 5 (krb5kdc) no fija variable global alguna para determinados tipos de mensaje krb4, la cual permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente ejecución de código de su elección mediante mensajes manipulados que disparan una referencia a un puntero nulo o doble liberación de memoria (double-free). • http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html http://marc.info/?l=bugtraq&m=130497213107107&w=2 http://secunia.com/advisories/29420 http://secunia.com/advisories/29423 http://secunia.com/advisories/29424 http://secunia.com/advisories/29428 http://secunia.com/advisories/29435 http://secunia.com/advisories/29438 http://secun • CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 4%CPEs: 19EXPL: 0CVE-2008-0063 – krb5: possible leak of sensitive data from krb5kdc using krb4 request
https://notcve.org/view.php?id=CVE-2008-0063
The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values." El soporte Kerberos 4 en KDC en MIT Kerberos 5 (krb5kdc) no borra apropiadamente la parte no utilizada de un búfer cuando se genera un mensaje de error, lo que podría permitir a los atacantes remotos obtener información confidencial, también se conoce como "Uninitialized stack values." • http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html http://secunia.com/advisories/29420 http://secunia.com/advisories/29423 http://secunia.com/advisories/29424 http://secunia.com/advisories/29428 http://secunia.com/advisories/29435 http://secunia.com/advisories/29438 http://secunia.com/advisories/29450 http://secunia.com/advisories/2 • CWE-908: Use of Uninitialized Resource •
CVSS: 9.3EPSS: 54%CPEs: 1EXPL: 0CVE-2008-0948 – krb5: incorrect handling of high-numbered file descriptors in RPC library
https://notcve.org/view.php?id=CVE-2008-0948
Buffer overflow in the RPC library (lib/rpc/rpc_dtablesize.c) used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define the FD_SETSIZE macro, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering a large number of open file descriptors. Un desbordamiento de búfer en la biblioteca RPC (lib/rpc/rpc_dtablesize.c) utilizada por libgssrpc y kadmind en MIT Kerberos 5 (krb5) versión 1.2.2, y probablemente otras versiones anteriores a 1.3, cuando se ejecuta en sistemas cuyo unistd.h no define la macro FD_SETSIZE, lo que permite a los atacantes remotos causar una denegación de servicio (bloqueo) y posiblemente ejecutar código arbitrario mediante la activación de un gran número de descriptores de archivos abiertos. • http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html http://marc.info/?l=bugtraq&m=130497213107107&w=2 http://secunia.com/advisories/29423 http://secunia.com/advisories/29424 http://secunia.com/advisories/29428 http://secunia.com/advisories/29663 http://secunia.com/advisories/30535 http://securityreason.com/securityalert/3752 http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022520.html http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •