what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Debian Security Advisory 3000-1

Debian Security Advisory 3000-1
Posted Aug 11, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3000-1 - Several vulnerabilities were discovered in krb5, the MIT implementation of Kerberos.

tags | advisory, vulnerability
systems | linux, debian
advisories | CVE-2014-4341, CVE-2014-4342, CVE-2014-4343, CVE-2014-4344, CVE-2014-4345
SHA-256 | 9e0bf167110ededceb1858ae76f9d9ae9089e225902c5c4500a77d626fe971c7

Debian Security Advisory 3000-1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3000-1 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
August 09, 2014 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : krb5
CVE ID : CVE-2014-4341 CVE-2014-4342 CVE-2014-4343 CVE-2014-4344
CVE-2014-4345
Debian Bug : 753624 753625 755520 755521 757416

Several vulnerabilities were discovered in krb5, the MIT implementation
of Kerberos. The Common Vulnerabilities and Exposures project identifies
the following problems:

CVE-2014-4341

An unauthenticated remote attacker with the ability to inject
packets into a legitimately established GSSAPI application session
can cause a program crash due to invalid memory references when
attempting to read beyond the end of a buffer.

CVE-2014-4342

An unauthenticated remote attacker with the ability to inject
packets into a legitimately established GSSAPI application session
can cause a program crash due to invalid memory references when
reading beyond the end of a buffer or by causing a null pointer
dereference.

CVE-2014-4343

An unauthenticated remote attacker with the ability to spoof packets
appearing to be from a GSSAPI acceptor can cause a double-free
condition in GSSAPI initiators (clients) which are using the SPNEGO
mechanism, by returning a different underlying mechanism than was
proposed by the initiator. A remote attacker could exploit this flaw
to cause an application crash or potentially execute arbitrary code.

CVE-2014-4344

An unauthenticated or partially authenticated remote attacker can
cause a NULL dereference and application crash during a SPNEGO
negotiation by sending an empty token as the second or later context
token from initiator to acceptor.

CVE-2014-4345

When kadmind is configured to use LDAP for the KDC database, an
authenticated remote attacker can cause it to perform an
out-of-bounds write (buffer overflow).

For the stable distribution (wheezy), these problems have been fixed in
version 1.10.1+dfsg-5+deb7u2.

For the unstable distribution (sid), these problems have been fixed in
version 1.12.1+dfsg-7.

We recommend that you upgrade your krb5 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJT5jYCAAoJEAVMuPMTQ89EdoEP/jEAoCdu8F/p6zMFcUFKKoiM
RjTaE6gjms8VWTp0weZcWApBWCXW3CFNQiErq9nd8borkPrWSDPTDug3h1Fc4/82
7Lw7xkCK90SJaSgdxB0QAj9mMIOd/2aR7YqL4nYo/1MC8snrwNrv+s9BKuk8Yypc
/9+cbjWt+zBiaUXCNN1H6ZyX3P/exV0Rx75hfvwr49WiiLflLB10qMlx1CKICrj7
ay1pK3k+uXFNYr+NfNjNjN4wxOQEJZPig93CeRtvnlMlU2fDeb2udvaJTqIODbqA
fY1rzEATJWnB3VMMGqIq21VDdPLizxA3GrPIQuFrDwwFRAViUQKdThpw2pBwpudH
RoKhoc2EqdxCgt9IsadupioUt68fPQQlVpY81983wIpvshR/lVWeP4r2ZUNOQcxX
Ql15VVmVG3eTo02Dy9WcIL9qH/urccFC8rF/9nwsJmrs0yZHXMEzLg9IjzisUd9i
deHpPMGVXe5THBGZWvI3ch18BStrdqlgWGJXQE29PWpPBNU1bhSY5IsF3SDy82O9
ZaSHhWFZ2rXKe3W8OQlFC+dd0AS/NQG3ES/JZwSf3c2CX/SswB+xR18xxy5zgb75
XgX85A5LjOyEmCl98b+wVC7zAEE3sNzKnHjMjD/LCC4CuMO+hlIPEaMhD3dYWg6Y
t5P2bMi/2wp4MyJKVYuY
=gD9n
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close