CVE-2014-4343

2014-08-1405:01:00

CWE-415

[email protected]

web.nvd.nist.gov

cve-2014-4343

double free vulnerability

spnego initiator

mit kerberos 5

remote attackers

denial of service

memory corruption

arbitrary code

network traffic

security mechanism

7.6 High

AI Score

Confidence

Low

7.6 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

0.033 Low

EPSS

Percentile

91.2%

JSON

Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

CPENameOperatorVersion
debian:debian_linuxdebian debian linuxeq7.0
mit:kerberos_5mit kerberos 5eq1.10
mit:kerberos_5mit kerberos 5eq1.10.1
mit:kerberos_5mit kerberos 5eq1.10.2
mit:kerberos_5mit kerberos 5eq1.10.3
mit:kerberos_5mit kerberos 5eq1.10.4
mit:kerberos_5mit kerberos 5eq1.11
mit:kerberos_5mit kerberos 5eq1.11.1
mit:kerberos_5mit kerberos 5eq1.11.2
mit:kerberos_5mit kerberos 5eq1.11.3

CPE	Name	Operator	Version
debian:debian_linux	debian debian linux	eq	7.0
mit:kerberos_5	mit kerberos 5	eq	1.10
mit:kerberos_5	mit kerberos 5	eq	1.10.1
mit:kerberos_5	mit kerberos 5	eq	1.10.2
mit:kerberos_5	mit kerberos 5	eq	1.10.3
mit:kerberos_5	mit kerberos 5	eq	1.10.4
mit:kerberos_5	mit kerberos 5	eq	1.11
mit:kerberos_5	mit kerberos 5	eq	1.11.1
mit:kerberos_5	mit kerberos 5	eq	1.11.2
mit:kerberos_5	mit kerberos 5	eq	1.11.3