CVSS: 6.5EPSS: 1%CPEs: 10EXPL: 0CVE-2014-9423 – krb5: libgssrpc server applications leak uninitialized bytes (MITKRB5-SA-2015-001)
https://notcve.org/view.php?id=CVE-2014-9423
04 Feb 2015 — The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field. La función svcauth_gss_accept_sec_context en lib/rpc/svc_auth_gss.c en MIT Kerberos 5 (también conocido como krb5) 1.11.x hasta 1.11.5, 1.12.x hasta 1.... • http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 9.0EPSS: 3%CPEs: 10EXPL: 0CVE-2014-5352 – krb5: gss_process_context_token() incorrectly frees context (MITKRB5-SA-2015-001)
https://notcve.org/view.php?id=CVE-2014-5352
03 Feb 2015 — The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind. La función krb5_gss_process... • http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 30EXPL: 0CVE-2014-5353 – krb5: NULL pointer dereference when using a ticket policy name as a password policy name
https://notcve.org/view.php?id=CVE-2014-5353
16 Dec 2014 — The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy. La función krb5_ldap_get_password_policy_from_dn en plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c en MIT Kerberos 5 (también conocido como krb5) a... • http://advisories.mageia.org/MGASA-2014-0536.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2014-5354 – Ubuntu Security Notice USN-2498-1
https://notcve.org/view.php?id=CVE-2014-5354
16 Dec 2014 — plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command. plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c en MIT Kerberos 5 (también conocido como krb5) 1.12.x y 1.13.x anterior a 1.13.1, cuando el... • http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-5351 – Gentoo Linux Security Advisory 201412-53
https://notcve.org/view.php?id=CVE-2014-5351
10 Oct 2014 — The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access. La función kadm5_randkey_principal_3 en lib/kadm5/srv/svr_principal.c en kadmind en MIT Kerberos 5 (también conocido como krb5) anterior a 1.13 envía claves viejas en respuesta a una solicitud -randkey -keepold, lo que permite a usua... • http://advisories.mageia.org/MGASA-2014-0477.html • CWE-255: Credentials Management Errors •
CVSS: 7.6EPSS: 7%CPEs: 18EXPL: 0CVE-2014-4343 – krb5: double-free flaw in SPNEGO initiators
https://notcve.org/view.php?id=CVE-2014-4343
11 Aug 2014 — Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator. Vulnerabilidad de doble liberación en la función init_ctx_reselect ... • http://advisories.mageia.org/MGASA-2014-0345.html • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 7.8EPSS: 9%CPEs: 18EXPL: 0CVE-2014-4344 – krb5: NULL pointer dereference flaw in SPNEGO acceptor for continuation tokens
https://notcve.org/view.php?id=CVE-2014-4344
11 Aug 2014 — The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation. La función acc_ctx_cont en el aceptador SPNEGO en lib/gssapi/spnego/spnego_mech.c en MIT Kerberos 5 (también conocido como krb5) 1.5.x hasta 1.12.x anterior a 1.12.2 permite a atacan... • http://advisories.mageia.org/MGASA-2014-0345.html • CWE-476: NULL Pointer Dereference •
CVSS: 10.0EPSS: 6%CPEs: 30EXPL: 0CVE-2014-4345 – krb5: buffer overrun in kadmind with LDAP backend (MITKRB5-SA-2014-001)
https://notcve.org/view.php?id=CVE-2014-4345
09 Aug 2014 — Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of "cpw -keepold" commands. Error de superación de límite (off-by-one) en la función krb5_encode_krbsecretkey en plugins/kdb/ldap/libkdb_ldap/ldap_princ... • http://advisories.mageia.org/MGASA-2014-0345.html • CWE-189: Numeric Errors CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 12%CPEs: 22EXPL: 0CVE-2014-4341 – krb5: denial of service flaws when handling padding length longer than the plaintext
https://notcve.org/view.php?id=CVE-2014-4341
20 Jul 2014 — MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session. MIT Kerberos 5 (también conocido como krb5) anterior a 1.12.2 permite a atacantes remotos causar una denegación de servicio (sobrelectura de buffer y caída de aplicación) mediante la inyección de tokens inválido en una sesión de la aplicación GSSAPI. A buffer over-read flaw was found in the way MIT Kerberos handle... • http://advisories.mageia.org/MGASA-2014-0345.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 8%CPEs: 35EXPL: 0CVE-2014-4342 – krb5: denial of service flaws when handling RFC 1964 tokens
https://notcve.org/view.php?id=CVE-2014-4342
20 Jul 2014 — MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session. MIT Kerberos 5 (también conocido como krb5) 1.7.x hasta 1.12.x anterior a 1.12.2 permite a atacantes remotos causar una denegación de servicio (sobrelectura de buffer o referencia a puntero nulo y caída de aplicación) mediante la inyección de tokens inválidos en un... • http://advisories.mageia.org/MGASA-2014-0345.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-476: NULL Pointer Dereference •