CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-7562 – krb5: Authentication bypass by improper validation of certificate EKU and SAN
https://notcve.org/view.php?id=CVE-2017-7562
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances. Se ha encontrado un error de omisión de autenticación en la forma en que la interfaz de certauth de krb5 en versiones anteriores a la 1.16.1 gestionaba la validación de los certificados de cliente. Un atacante remoto capaz de comunicarse con el KDC podría utilizar este fallo para hacerse pasar por directores arbitrarios en circunstancias poco frecuentes y erróneas. An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. • http://www.securityfocus.com/bid/100511 https://access.redhat.com/errata/RHSA-2018:0666 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7562 https://github.com/krb5/krb5/pull/694 https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196 https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2 https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627d https://access.redhat.com/security/cve/CVE-2017-7562 https:/ • CWE-287: Improper Authentication CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2017-15088
https://notcve.org/view.php?id=CVE-2017-15088
plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat. plugins/preauth/pkinit/pkinit_crypto_openssl.c en MIT Kerberos 5 (también conocido como krb5) hasta la versión 1.15.2 gestiona de manera incorrecta los campos Distinguished Name (DN). Esto permite que atacantes remotos ejecuten código arbitrario o provoquen una denegación de servicio (desbordamiento de búfer y cierre inesperado de la aplicación) en situaciones relacionadas con datos X.509 no fiables. Esto se relaciona con las funciones get_matching_data y X509_NAME_oneline_ex. NOTA: esto es relevante para la seguridad solo en casos externos a la distribución de MIT Kerberos, por ejemplo, el uso de get_matching_data en el código del plugin KDC certauth específico de Red Hat. • http://www.securityfocus.com/bid/101594 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871698 https://bugzilla.redhat.com/show_bug.cgi?id=1504045 https://github.com/krb5/krb5/commit/fbb687db1088ddd894d975996e5f6a4252b9a2b4 https://github.com/krb5/krb5/pull/707 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 6.5EPSS: 0%CPEs: 51EXPL: 0CVE-2017-11368 – krb5: Invalid S4U2Self or S4U2Proxy request causes assertion failure
https://notcve.org/view.php?id=CVE-2017-11368
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. En MIT Kerberos 5 (también llamado krb5) en versiones 1.7 y posteriores, un atacante autenticado puede provocar un error de aserción KDC mediante el envío de peticiones S4U2Self o S4U2Proxy no válidas. A denial of service flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request. • http://www.securityfocus.com/bid/100291 https://access.redhat.com/errata/RHSA-2018:0666 https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HNWXM6OQU7G23MG7XWIOBRGP43ECLDT https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBUTXMNZWMVJLQ4NDX5OQFPUVCJRLV3W https://access.redhat.com/security/cve/CVE-2017-11368 https://bugzilla.redhat.com/show_bug.cgi?id=1473560 • CWE-617: Reachable Assertion •
CVSS: 6.5EPSS: 4%CPEs: 10EXPL: 0CVE-2016-3120 – krb5: S4U2Self KDC crash when anon is restricted
https://notcve.org/view.php?id=CVE-2016-3120
The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request. La función validate_as_request en kdc_util.c en el Key Distribution Center (KDC) en MIT Kerberos 5 (también conocido como krb5) en versiones anteriores a 1.13.6 y 1.4.x en versiones anteriores a 1.14.3, cuando restrict_anonymous_to_tgt está activo, utiliza una estructura de datos de clientes incorrecta, lo que permite a usuarios remotos autenticados provocar una denegación de servicio (referencia al puntero NULO y caída de daemon) a través de una petición S4U2Selft. A NULL pointer dereference flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to dereference a null pointer and crash by making an S4U2Self request, if the restrict_anonymous_to_tgt option was set to true. • http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458 http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html http://rhn.redhat.com/errata/RHSA-2016-2591.html http://web.mit.edu/kerberos/krb5-1.13 http://web.mit.edu/kerberos/krb5-1.14 http://www.securityfocus.com/bid/92132 http://www.securitytracker.com/id/1036442 https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7 https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html https:/&# • CWE-476: NULL Pointer Dereference •
CVSS: 5.3EPSS: 5%CPEs: 76EXPL: 0CVE-2016-3119 – krb5: null pointer dereference in kadmin
https://notcve.org/view.php?id=CVE-2016-3119
The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal. La función process_db_args en plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c en el módulo LDAP KDB en kadmind en MIT Kerberos 5 (también conocido como krb5) hasta la versión 1.13.4 y 1.14.x hasta la versión 1.14.1 no maneja adecuadamente el argumento DB, lo que permite a usuarios remotros autenticados provocar una denegación de servicio (referencia a puntero NULL y caída de demonio) a través de una petición manipulada para modificar una principal. A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a null pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module. • http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html http://rhn.redhat.com/errata/RHSA-2016-2591.html http://www.securityfocus.com/bid/85392 http://www.securitytracker.com/id/1035399 https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99 https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html https://access.redhat.com/security/cve/CVE-2016-3119 https://bugzilla.redhat.com/show_bug& • CWE-476: NULL Pointer Dereference •