CVE-2014-9421
krb5: kadmind doubly frees partial deserialization results (MITKRB5-SA-2015-001)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.
La función auth_gssapi_unwrap_data en lib/rpc/auth_gssapi_misc.c en MIT Kerberos 5 (también conocido como krb5) hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 no maneja correctamente la deserialización XDR parcial, lo que permite a usuarios remotos autenticados causar una denegación de servicio (uso después de liberación y doble liberación, y caída del demonio) o posiblemente ejecutar código arbitrario a través de datos XDR malformados, tal y como fue demostrado mediante datos enviados a kadmind.
A double-free flaw was found in the way MIT Kerberos handled invalid External Data Representation (XDR) data. An authenticated user could use this flaw to crash the MIT Kerberos administration server (kadmind), or other applications using Kerberos libraries, using specially crafted XDR packets.
A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. A remote, unauthenticated attacker could use this flaw to crash a GSSAPI-enabled server application. A buffer overflow was found in the KADM5 administration server when it was used with an LDAP back end for the KDC database. A remote, authenticated attacker could potentially use this flaw to execute arbitrary code on the system running kadmind. A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library call the gss_process_context_token() function could use this flaw to crash that application.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-12-26 CVE Reserved
- 2015-02-04 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (16)
| URL | Tag | Source |
|---|---|---|
| http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt | X_refsource_confirm | |
| http://www.securityfocus.com/bid/72496 | Vdb Entry | |
| https://github.com/krb5/krb5/commit/a197e92349a4aa2141b5dff12e9dd44c2a2166e3 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.11 Search vendor "Mit" for product "Kerberos 5" and version "1.11" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.11.1 Search vendor "Mit" for product "Kerberos 5" and version "1.11.1" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.11.2 Search vendor "Mit" for product "Kerberos 5" and version "1.11.2" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.11.3 Search vendor "Mit" for product "Kerberos 5" and version "1.11.3" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.11.4 Search vendor "Mit" for product "Kerberos 5" and version "1.11.4" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.11.5 Search vendor "Mit" for product "Kerberos 5" and version "1.11.5" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.12 Search vendor "Mit" for product "Kerberos 5" and version "1.12" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.12.1 Search vendor "Mit" for product "Kerberos 5" and version "1.12.1" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.12.2 Search vendor "Mit" for product "Kerberos 5" and version "1.12.2" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.13 Search vendor "Mit" for product "Kerberos 5" and version "1.13" | - |
Affected
| ||||||