861 matches found
FreeBSD : FreeBSD -- heimdal KDC-REP service name validation vulnerability (420243e9-a840-11e7-b5af-a4badb2f4699)
There is a programming error in the Heimdal implementation that used an unauthenticated, plain-text version of the KDC-REP service name found in a ticket. Impact : An attacker who has control of the network between a client and the service it talks to will be able to impersonate the service,...
openSUSE Security Update : samba and resource-agents (openSUSE-2017-987) (Orpheus' Lyre)
This update provides Samba 4.6.7, which fixes the following issues : - CVE-2017-11103: Metadata were being taken from the unauthenticated plaintext the Ticket rather than the authenticated and encrypted KDC response. bsc1048278 - Fix cephwrapchdir. bsc1048790 - Fix ctdb logs to /var/log/log.ctdb...
CVE-2017-7562
An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances...
CVE-2015-3206
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...
PYSEC-2017-49
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...
Design/Logic Flaw
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...
CVE-2015-3206
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...
PYSEC-2017-66
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...
CVE-2015-3206
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...
CVE-2015-3206
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...
[SECURITY] [DSA 3950-1] libraw security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3950-1 [email protected] https://www.debian.org/security/ Luciano Bello August 21, 2017 https://www.debian.org/security/faq -...
openSUSE Security Update : libheimdal (openSUSE-2017-937) (Orpheus' Lyre)
This update for libheimdal fixes the following issues : - Fix CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation. This is a critical vulnerability. In krb5extractticket the KDC-REP service name must be obtained from encrypted version stored in 'encpart' instead of the unencrypted versi...
Debian DLA-1058-1 : krb5 security update
In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. For Debian 7 'Wheezy', these problems have been fixed in version 1.10.1+dfsg-5+deb7u8. We recommend that you upgrade your krb5 packages. NOTE:...
[SECURITY] [DLA 1058-1] krb5 security update
From: Lucas Kanashiro [email protected] To: [email protected] Subject: SECURITY DLA 1058-1 krb5 security update Package : krb5 Version : 1.10.1+dfsg-5+deb7u8 CVE ID : CVE-2017-11368 Debian Bug : 869260 In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can...
MIT Kerberos 5 S4U2Self or S4U2Proxy Request Denial of Service Vulnerability
MIT Kerberos 5 is a set of network authentication protocols, which uses a client/server structure, and both the client and server side can authenticate each other, preventing eavesdropping, preventing replay attacks and so on. MIT Kerberos 5 has a security vulnerability in handling invalid S4U2Se...
DEBIAN-CVE-2017-11368
In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests...
CVE-2017-11368
In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests...
CVE-2017-11368
In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation. In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. Remediation There is no fixed version for krb5. Referenc...