CVSS: 5.0EPSS: 95%CPEs: 60EXPL: 0CVE-2014-5355 – krb5: unauthenticated denial of service in recvauth_common() and others
https://notcve.org/view.php?id=CVE-2014-5355
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c. MIT Kerberos 5 (también conocido como krb5) hasta 1.13.1 espera incorrectamente que un campo de datos krb5_read_message se representa como una cadena que termine con un caracter '\0', lo que permite a atacantes remotos (1) causar una denegación de servicio (referencia a puntero nulo) a través de una cadena de versión de cero bytes o (2) causar una denegación de servicio (lectura fuera de rango) mediante la omisión del caracter '\0', relacionado con appl/user_user/server.c y lib/krb5/krb/recvauth.c. It was found that the krb5_read_message() function of MIT Kerberos did not correctly sanitize input, and could create invalid krb5_data objects. A remote, unauthenticated attacker could use this flaw to crash a Kerberos child process via a specially crafted request. • http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050 http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html http://rhn.redhat.com/errata/RHSA-2015-0794.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.securityfocus.com/bid/74042 http://www.ubuntu.com/usn/USN-2810-1 https://github.com • CWE-476: NULL Pointer Dereference •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2014-9423 – krb5: libgssrpc server applications leak uninitialized bytes (MITKRB5-SA-2015-001)
https://notcve.org/view.php?id=CVE-2014-9423
The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field. La función svcauth_gss_accept_sec_context en lib/rpc/svc_auth_gss.c en MIT Kerberos 5 (también conocido como krb5) 1.11.x hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 trasmite datos intercalados no inicializados a clientes, lo que permite a atacantes remotos obtener información sensible de la memoria dinámica de procesos mediante la captura de trafico de la red para datos en un campo de manejo (handle). An information disclosure flaw was found in the way MIT Kerberos RPCSEC_GSS implementation (libgssrpc) handled certain requests. An attacker could send a specially crafted request to an application using libgssrpc to disclose a limited portion of uninitialized memory used by that application. • http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html http://rhn.redhat.com/errata/RHSA-2015-0439.html http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt http://we • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 9.0EPSS: 1%CPEs: 10EXPL: 0CVE-2014-9421 – krb5: kadmind doubly frees partial deserialization results (MITKRB5-SA-2015-001)
https://notcve.org/view.php?id=CVE-2014-9421
The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind. La función auth_gssapi_unwrap_data en lib/rpc/auth_gssapi_misc.c en MIT Kerberos 5 (también conocido como krb5) hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 no maneja correctamente la deserialización XDR parcial, lo que permite a usuarios remotos autenticados causar una denegación de servicio (uso después de liberación y doble liberación, y caída del demonio) o posiblemente ejecutar código arbitrario a través de datos XDR malformados, tal y como fue demostrado mediante datos enviados a kadmind. A double-free flaw was found in the way MIT Kerberos handled invalid External Data Representation (XDR) data. An authenticated user could use this flaw to crash the MIT Kerberos administration server (kadmind), or other applications using Kerberos libraries, using specially crafted XDR packets. • http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html http://rhn.redhat.com/errata/RHSA-2015-0439.html http://rhn.redhat.com/errata/RHSA-2015-0794.html http://web.mit.edu/ • CWE-416: Use After Free •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2014-9422 – krb5: kadmind incorrectly validates server principal name (MITKRB5-SA-2015-001)
https://notcve.org/view.php?id=CVE-2014-9422
The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal. La función check_rpcsec_auth en kadmin/server/kadm_rpc_svc.c en kadmind en MIT Kerberos 5 (también conocido como krb5) hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 permite a usuarios remotos autenticados evadir una comprobación de la autorización kadmin/* y obtener acceso administrativo mediante el aprovechamiento del acceso a un principal de dos componentes con una subcadena 'kadmind' inicial, tal y como fue demostrado por un principal 'ka/x'. It was found that the MIT Kerberos administration server (kadmind) incorrectly accepted certain authentication requests for two-component server principal names. A remote attacker able to acquire a key with a particularly named principal (such as "kad/x") could use this flaw to impersonate any user to kadmind, and perform administrative actions as that user. • http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html http://rhn.redhat.com/errata/RHSA-2015-0439.html http://rhn.redhat.com/errata/RHSA-2015-0794.html http://web.mit.edu/ • CWE-284: Improper Access Control CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 9.0EPSS: 1%CPEs: 10EXPL: 0CVE-2014-5352 – krb5: gss_process_context_token() incorrectly frees context (MITKRB5-SA-2015-001)
https://notcve.org/view.php?id=CVE-2014-5352
The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind. La función krb5_gss_process_context_token en lib/gssapi/krb5/process_context_token.c en la libraría libgssapi_krb5 en MIT Kerberos 5 (también conocido como krb5) hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 no mantiene correctamente los manejos en el contexto de seguridad, lo que permite a usuarios remotos autenticados causar una denegación de servicio (uso después de liberación y doble liberación, y caída del demonio) o posiblemente ejecutar código arbitrario a través de trafico GSSAPI manipulado, tal y como fue demostrado por trafico a kadmind. A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library (libgssapi) call the gss_process_context_token() function could use this flaw to crash that application. • http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html http://rhn.redhat.com/errata/RHSA-2015-0439.html http://rhn.redhat.com/errata/RHSA-2015-0794.html http://web.mit.edu/ • CWE-416: Use After Free •