CVSS: 5.0EPSS: 95%CPEs: 60EXPL: 0CVE-2014-5355 – krb5: unauthenticated denial of service in recvauth_common() and others
https://notcve.org/view.php?id=CVE-2014-5355
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c. MIT Kerberos 5 (también conocido como krb5) hasta 1.13.1 espera incorrectamente que un campo de datos krb5_read_message se representa como una cadena que termine con un caracter '\0', lo que permite a atacantes remotos (1) causar una denegación de servicio (referencia a puntero nulo) a través de una cadena de versión de cero bytes o (2) causar una denegación de servicio (lectura fuera de rango) mediante la omisión del caracter '\0', relacionado con appl/user_user/server.c y lib/krb5/krb/recvauth.c. It was found that the krb5_read_message() function of MIT Kerberos did not correctly sanitize input, and could create invalid krb5_data objects. A remote, unauthenticated attacker could use this flaw to crash a Kerberos child process via a specially crafted request. • http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050 http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html http://rhn.redhat.com/errata/RHSA-2015-0794.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.securityfocus.com/bid/74042 http://www.ubuntu.com/usn/USN-2810-1 https://github.com • CWE-476: NULL Pointer Dereference •
CVSS: 3.5EPSS: 0%CPEs: 30EXPL: 0CVE-2014-5353 – krb5: NULL pointer dereference when using a ticket policy name as a password policy name
https://notcve.org/view.php?id=CVE-2014-5353
The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy. La función krb5_ldap_get_password_policy_from_dn en plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c en MIT Kerberos 5 (también conocido como krb5) anterior a 1.13.1, cuando el KDC utiliza LDAP, permite a usuarios remotos autenticados causar una denegación de servicio (caída del demonio) a través de una consulta LDAP con éxito pero sin resultados, tal y como fue demostrado mediante el uso de un tipo de objeto incorrecto para una política de contraseñas. If kadmind were used with an LDAP back end for the KDC database, a remote, authenticated attacker who has the permissions to set the password policy could crash kadmind by attempting to use a named ticket policy object as a password policy for a principal. • http://advisories.mageia.org/MGASA-2014-0536.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html http://rhn.redhat.com/errata/RHSA-2015-0439.html http://rhn.redhat.com/errata/RHSA-2015-0794.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:009 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.securityfocus.com/bid/71679 http://www.sec • CWE-476: NULL Pointer Dereference •
CVSS: 7.6EPSS: 3%CPEs: 18EXPL: 0CVE-2014-4343 – krb5: double-free flaw in SPNEGO initiators
https://notcve.org/view.php?id=CVE-2014-4343
Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator. Vulnerabilidad de doble liberación en la función init_ctx_reselect en el iniciador SPNEGO en lib/gssapi/spnego/spnego_mech.c en MIT Kerberos 5 (también conocido como krb5) 1.10.x hasta 1.12.x anterior a 1.12.2 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria) o posiblemente ejecutar código arbitrario a través de trafico de la red que parece venir de un aceptador intencionado, pero especifica un mecanismo de seguridad diferente al propuesto por el iniciador. A double-free flaw was found in the MIT Kerberos SPNEGO initiators. An attacker able to spoof packets to appear as though they are from an GSSAPI acceptor could use this flaw to crash a client application that uses MIT Kerberos. • http://advisories.mageia.org/MGASA-2014-0345.html http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc http://krbdev.mit.edu/rt/Ticket/Display.html?id=7969 http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html http://rhn.redhat.com/errata/RHSA-2015-0439.html http://secunia.com/advisories/59102 http://secunia.com/advisories/60082 http://secunia.com/advisories/60448 http://secunia.com/advisories/61052 http://security.gentoo.org/glsa/glsa • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 7.8EPSS: 11%CPEs: 18EXPL: 0CVE-2014-4344 – krb5: NULL pointer dereference flaw in SPNEGO acceptor for continuation tokens
https://notcve.org/view.php?id=CVE-2014-4344
The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation. La función acc_ctx_cont en el aceptador SPNEGO en lib/gssapi/spnego/spnego_mech.c en MIT Kerberos 5 (también conocido como krb5) 1.5.x hasta 1.12.x anterior a 1.12.2 permite a atacantes remotos causar una denegación de servicio (referencia a puntero nulo y caída de la aplicación) a través de un token de continuación vacío en cierto momento durante una negociación SPNEGO. A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. A remote, unauthenticated attacker could use this flaw to crash a GSSAPI-enabled server application. • http://advisories.mageia.org/MGASA-2014-0345.html http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970 http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html http://rhn.redhat.com/errata/RHSA-2015-0439.html http://secunia.com/advisories/59102 http://secunia.com/advisories/60082 http://secunia.com/advisories/60448 http://secunia.com/advisories/61051 http://support.f5.com/kb/en-us&# • CWE-476: NULL Pointer Dereference •
CVSS: 8.5EPSS: 1%CPEs: 30EXPL: 0CVE-2014-4345 – krb5: buffer overrun in kadmind with LDAP backend (MITKRB5-SA-2014-001)
https://notcve.org/view.php?id=CVE-2014-4345
Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of "cpw -keepold" commands. Error de superación de límite (off-by-one) en la función krb5_encode_krbsecretkey en plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c en el módulo LDAP KDB en kadmind en MIT Kerberos 5 (también conocido como krb5) 1.6.x hasta 1.11.x anterior a 1.11.6 y 1.12.x anterior a 1.12.2 permite a usuarios remotos autenticados causar una denegación de servicio (desbordamiento de buffer) o posiblemente ejecutar código arbitrario a través de una serie de comandos 'cpw -keepold'. A buffer overflow was found in the KADM5 administration server (kadmind) when it was used with an LDAP back end for the KDC database. A remote, authenticated attacker could potentially use this flaw to execute arbitrary code on the system running kadmind. • http://advisories.mageia.org/MGASA-2014-0345.html http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://krbdev.mit.edu/rt/Ticket/Display.html?id=7980 http://linux.oracle.com/errata/ELSA-2014-1255.html http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136640.html http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137056.html http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00009.html http://lists.opensuse.org/opensuse-updates& • CWE-189: Numeric Errors CWE-787: Out-of-bounds Write •