CVSS: 7.5EPSS: 3%CPEs: 22EXPL: 0CVE-2014-4341 – krb5: denial of service flaws when handling padding length longer than the plaintext
https://notcve.org/view.php?id=CVE-2014-4341
20 Jul 2014 — MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session. MIT Kerberos 5 (también conocido como krb5) anterior a 1.12.2 permite a atacantes remotos causar una denegación de servicio (sobrelectura de buffer y caída de aplicación) mediante la inyección de tokens inválido en una sesión de la aplicación GSSAPI. A buffer over-read flaw was found in the way MIT Kerberos handle... • http://advisories.mageia.org/MGASA-2014-0345.html • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 1%CPEs: 4EXPL: 1CVE-2013-1417 – Gentoo Linux Security Advisory 201312-12
https://notcve.org/view.php?id=CVE-2013-1417
20 Nov 2013 — do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal. do_tgs_req.c en Key Distribution Center (KDC) de Kerberos 5 (también conocido como krb5) 1.11 anterior a la versión 1.11.4, cuando el nombre realm de un único componente es usado, permi... • http://lists.opensuse.org/opensuse-updates/2013-12/msg00026.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2013-6800 – krb5: KDC remote DoS (NULL pointer dereference and daemon crash)
https://notcve.org/view.php?id=CVE-2013-6800
16 Nov 2013 — An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request, a different vulnerability than CVE-2013-1418. Un módulo de base de datos de terceros sin especificar para Key Distribution Center (KDC) en MIT Kerberos 5 (también conocido como krb5) 1.10.x permite a usuarios remotos autenticados provocar una denegación de servicio... • http://krbdev.mit.edu/rt/Ticket/Display.html?id=7757 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 82%CPEs: 6EXPL: 0CVE-2013-1418 – krb5: multi-realm KDC null dereference leads to crash
https://notcve.org/view.php?id=CVE-2013-1418
16 Nov 2013 — The setup_server_realm function in main.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request. La función setup_server_realm en main.c en Key Distribution Center (KDC) de MIT Kerberos 5 (también conocido como krb5) anterior a la versión 1.10.7, cuando se configuran varios campos, permite a atacantes remotos provocar una deneg... • http://advisories.mageia.org/MGASA-2013-0335.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 78%CPEs: 23EXPL: 0CVE-2002-2443 – krb5: UDP ping-pong flaw in kpasswd
https://notcve.org/view.php?id=CVE-2002-2443
21 May 2013 — schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103. schpw.c en el servicio kpasswd en kadmind en MIT Kerberos 5 (conocido como krb5) anterior a v1.11.3 no valida correctamente los paquetes UDP an... • http://krbdev.mit.edu/rt/Ticket/Display.html?id=7637 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 94%CPEs: 12EXPL: 0CVE-2013-1416 – krb5: NULL pointer dereference (DoS, KDC crash) by processing certain TGS requests
https://notcve.org/view.php?id=CVE-2013-1416
19 Apr 2013 — The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request. La función prep_reprocess_req en do_tgs_req.c en el Key Distribution Center (KDC) en MIT Kerberos 5 (aka krb5) antes de v1.10.5 no realiza correctamente el servicio ámbito de refer... • http://krbdev.mit.edu/rt/Ticket/Display.html?id=7600 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-1016 – krb5: PKINIT null pointer deref leads to DoS
https://notcve.org/view.php?id=CVE-2012-1016
03 Mar 2013 — The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request. La función pkinit_server_return_padata en plugins/preauth/pkinit/pkinit_srv.c en la implementación PKINIT en el Ke... • http://krbdev.mit.edu/rt/Ticket/Display.html?id=7527 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 7%CPEs: 3EXPL: 0CVE-2013-1415 – krb5: PKINIT null pointer deref leads to DoS (pkinit_check_kdc_pkid())
https://notcve.org/view.php?id=CVE-2013-1415
03 Mar 2013 — The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request. La función pkinit_check_kdc_pkid en plugins / PRE... • http://krbdev.mit.edu/rt/Ticket/Display.html?id=7570 • CWE-476: NULL Pointer Dereference •
CVSS: 9.3EPSS: 12%CPEs: 11EXPL: 0CVE-2012-1015 – krb5: KDC daemon crash via free() of an uninitialized pointer
https://notcve.org/view.php?id=CVE-2012-1015
06 Aug 2012 — The kdc_handle_protected_negotiation function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x before 1.9.5, and 1.10.x before 1.10.3 attempts to calculate a checksum before verifying that the key type is appropriate for a checksum, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free, heap memory corruption, and daemon crash) via a crafted AS-REQ request. La función kdc_handle_protected_negotiation en Key Distribution... • http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.html • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 3%CPEs: 3EXPL: 0CVE-2012-1014 – Gentoo Linux Security Advisory 201312-12
https://notcve.org/view.php?id=CVE-2012-1014
06 Aug 2012 — The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a malformed AS-REQ request. La función process_as_req en Key Distribution Center (KDC) en MIT Kerberos 5 (también conocido como krb5) v1.10.x anteriores a v1.10.3 no inicializa ciertos miembros de l... • http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.html •