what you don't know can hurt you

Debian Security Advisory 3000-1

Debian Security Advisory 3000-1
Posted Aug 11, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3000-1 - Several vulnerabilities were discovered in krb5, the MIT implementation of Kerberos.

tags | advisory, vulnerability
systems | linux, debian
advisories | CVE-2014-4341, CVE-2014-4342, CVE-2014-4343, CVE-2014-4344, CVE-2014-4345
MD5 | e56a2c4abed937a19a110da6304ba0a2

Debian Security Advisory 3000-1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3000-1 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
August 09, 2014 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : krb5
CVE ID : CVE-2014-4341 CVE-2014-4342 CVE-2014-4343 CVE-2014-4344
CVE-2014-4345
Debian Bug : 753624 753625 755520 755521 757416

Several vulnerabilities were discovered in krb5, the MIT implementation
of Kerberos. The Common Vulnerabilities and Exposures project identifies
the following problems:

CVE-2014-4341

An unauthenticated remote attacker with the ability to inject
packets into a legitimately established GSSAPI application session
can cause a program crash due to invalid memory references when
attempting to read beyond the end of a buffer.

CVE-2014-4342

An unauthenticated remote attacker with the ability to inject
packets into a legitimately established GSSAPI application session
can cause a program crash due to invalid memory references when
reading beyond the end of a buffer or by causing a null pointer
dereference.

CVE-2014-4343

An unauthenticated remote attacker with the ability to spoof packets
appearing to be from a GSSAPI acceptor can cause a double-free
condition in GSSAPI initiators (clients) which are using the SPNEGO
mechanism, by returning a different underlying mechanism than was
proposed by the initiator. A remote attacker could exploit this flaw
to cause an application crash or potentially execute arbitrary code.

CVE-2014-4344

An unauthenticated or partially authenticated remote attacker can
cause a NULL dereference and application crash during a SPNEGO
negotiation by sending an empty token as the second or later context
token from initiator to acceptor.

CVE-2014-4345

When kadmind is configured to use LDAP for the KDC database, an
authenticated remote attacker can cause it to perform an
out-of-bounds write (buffer overflow).

For the stable distribution (wheezy), these problems have been fixed in
version 1.10.1+dfsg-5+deb7u2.

For the unstable distribution (sid), these problems have been fixed in
version 1.12.1+dfsg-7.

We recommend that you upgrade your krb5 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJT5jYCAAoJEAVMuPMTQ89EdoEP/jEAoCdu8F/p6zMFcUFKKoiM
RjTaE6gjms8VWTp0weZcWApBWCXW3CFNQiErq9nd8borkPrWSDPTDug3h1Fc4/82
7Lw7xkCK90SJaSgdxB0QAj9mMIOd/2aR7YqL4nYo/1MC8snrwNrv+s9BKuk8Yypc
/9+cbjWt+zBiaUXCNN1H6ZyX3P/exV0Rx75hfvwr49WiiLflLB10qMlx1CKICrj7
ay1pK3k+uXFNYr+NfNjNjN4wxOQEJZPig93CeRtvnlMlU2fDeb2udvaJTqIODbqA
fY1rzEATJWnB3VMMGqIq21VDdPLizxA3GrPIQuFrDwwFRAViUQKdThpw2pBwpudH
RoKhoc2EqdxCgt9IsadupioUt68fPQQlVpY81983wIpvshR/lVWeP4r2ZUNOQcxX
Ql15VVmVG3eTo02Dy9WcIL9qH/urccFC8rF/9nwsJmrs0yZHXMEzLg9IjzisUd9i
deHpPMGVXe5THBGZWvI3ch18BStrdqlgWGJXQE29PWpPBNU1bhSY5IsF3SDy82O9
ZaSHhWFZ2rXKe3W8OQlFC+dd0AS/NQG3ES/JZwSf3c2CX/SswB+xR18xxy5zgb75
XgX85A5LjOyEmCl98b+wVC7zAEE3sNzKnHjMjD/LCC4CuMO+hlIPEaMhD3dYWg6Y
t5P2bMi/2wp4MyJKVYuY
=gD9n
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

June 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    35 Files
  • 2
    Jun 2nd
    14 Files
  • 3
    Jun 3rd
    40 Files
  • 4
    Jun 4th
    22 Files
  • 5
    Jun 5th
    1 Files
  • 6
    Jun 6th
    1 Files
  • 7
    Jun 7th
    19 Files
  • 8
    Jun 8th
    14 Files
  • 9
    Jun 9th
    39 Files
  • 10
    Jun 10th
    20 Files
  • 11
    Jun 11th
    22 Files
  • 12
    Jun 12th
    2 Files
  • 13
    Jun 13th
    1 Files
  • 14
    Jun 14th
    32 Files
  • 15
    Jun 15th
    34 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close