Lucene search

K
mageiaGentoo FoundationMGASA-2014-0345
HistoryAug 22, 2014 - 2:58 p.m.

Updated krb5 package fixes security vulnerabilities

2014-08-2214:58:14
Gentoo Foundation
advisories.mageia.org
6

8.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

0.277 Low

EPSS

Percentile

96.8%

MIT Kerberos 5 allows attackers to cause a denial of service via a buffer over-read or NULL pointer dereference, by injecting invalid tokens into a GSSAPI application session (CVE-2014-4341, CVE-2014-4342). MIT Kerberos 5 allows attackers to cause a denial of service via a double-free flaw or NULL pointer dereference, while processing invalid SPNEGO tokens (CVE-2014-4343, CVE-2014-4344). In MIT Kerberos 5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause it to perform an out-of-bounds write (buffer overflow) (CVE-2014-4345).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchkrb5< 1.11.1-1.4krb5-1.11.1-1.4.mga3
Mageia4noarchkrb5< 1.11.4-1.1krb5-1.11.4-1.1.mga4

8.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

0.277 Low

EPSS

Percentile

96.8%