MIT Kerberos 5 KDC多个内存破坏信息泄露漏洞

BUGTRAQ ID: 28303 CVECAN ID: CVE-2008-0062,CVE-2008-0063 Kerberos是一款广泛使用的使用强壮的加密来验证客户端和服务器端的网络协议。MIT Kerberos 5是一种常用的开源Kerberos实现。 Kerberos 5的实现上存在两个漏洞，远程攻击者可能利用此漏洞导致拒绝服务或获取敏感信息。 如果Kerberos 5 KDC中启用了Kerberos 4支持的话，发送畸形消息可能会触发两个漏洞： CVE-2008-0062：如果KDC接收到了畸形的Kerberos 4消息的话，且之前没有Kerberos...

CVE-2008-0062

MIT Kerberos 5 krb5kdc is affected by CVE-2008-0062 (and related CVEs) where the KDC may crash or possibly allow remote code execution via crafted Kerberos v4 messages, due to not initializing a global variable which can cause a NULL pointer dereference or a double-free. This results in denial of...

krb5 security update

CentOS Errata and Security Advisory CESA-2008:0164 Updated krb5 packages that resolve several issues and fix multiple bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network...

USN-587-1: Kerberos vulnerabilities

It was discovered that krb5 did not correctly handle certain krb4 requests. An unauthenticated remote attacker could exploit this flaw by sending a specially crafted traffic, which could expose sensitive information, cause a crash, or execute arbitrary code. CVE-2008-0062, CVE-2008-0063 A flaw wa...

MITKRB5-SA-2008-001: double-free, uninitialized data vulnerabilities in krb5kdc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2008-001 MIT krb5 Security Advisory 2008-001 Original release: 2008-03-18 Last update: 2008-03-18 Topic: double-free, uninitialized data vulnerabilities in krb5kdc CVE-2008-0062 VU895609 Use of a null or dangling pointer in the MIT Kerberos...

openSUSE 10 Security Update : krb5 (krb5-5081)

This update fixes the following security bugs in krb5/krb5-server : - CVE-2008-0062: null/dangling pointer needs enabled krb4 support - CVE-2008-0063: possible operations on uninitialized buffer content/information leak needs enabled krb4 support - CVE-2008-0947/CVE-2008-0948: out-of-bound array...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : krb5 vulnerabilities (USN-587-1)

It was discovered that krb5 did not correctly handle certain krb4 requests. An unauthenticated remote attacker could exploit this flaw by sending a specially crafted traffic, which could expose sensitive information, cause a crash, or execute arbitrary code. CVE-2008-0062, CVE-2008-0063 A flaw wa...

CentOS 3 : krb5 (CESA-2008:0181)

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and servers to...

krb5 security update

CentOS Errata and Security Advisory CESA-2008:0181 Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network...

Critical: Red Hat Security Advisory: krb5 security and bugfix update

Updated krb5 packages that resolve several issues and fix multiple bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and serve...

Critical: Red Hat Security Advisory: krb5 security update

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.5 Extended Update Support. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients...

[SECURITY] [DSA 1524-1] New krb5 packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1524-1 [email protected] http://www.debian.org/security/ Noah Meyerhans March 18, 2008 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1524-1] New krb5 packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1524-1 [email protected] http://www.debian.org/security/ Noah Meyerhans March 18, 2008 http://www.debian.org/security/faq -...

Critical: Red Hat Security Advisory: krb5 security update

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and servers to authentica...

Critical: krb5 security update

1.3.4-54.el46.1 - add preliminary patch to fix use of uninitialized pointer / double-free in KDC CVE-2008-0062,CVE-2008-0063 432620, 432621 - add backported patch to fix double-free in libgssapikrb5 CVE-2007-5971 415351...

Debian Security Advisory DSA 113-1 (ncurses)

The remote host is missing an update to ncurses announced via advisory DSA 113-1. OpenVAS Vulnerability Test $Id: deb1131.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 113-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 113-1 (ncurses)

The remote host is missing an update to ncurses announced via advisory DSA 113-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

VMware Workstation < 5.5.5 and Server < 1.0.4 Multiple Vulnerabilities

The version of VMware Workstation/Server installed on the remote host is affected by multiple vulnerabilities, including a privelege elevation vulnerability that allows a guest to take over a host and a buffer overflow vulnerability in the DHCP daemon. The buffer overlflow in the DHCP server may...

CVE-2007-0062

CVE-2007-0062: The vulnerability affects ISC DHCPD 3.0.x (before 3.0.7) and 3.1.x (before 3.1.1), plus the DHCP servers in VMware Workstation/Player, ACE, and related products. It is caused by a stack-based buffer overflow triggered by a malformed DHCP packet with a large dhcp-max-message-size, p...

Debian DSA-113-1 : ncurses - buffer overflow

Several buffer overflows were fixed in the 'ncurses' library in November 2000. Unfortunately, one was missed. This can lead to crashes when using ncurses applications in large windows. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0062 to this issue. This problem...