CVE-2020-28196

MIT Kerberos 5 aka krb5 before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1encode.c support for BER indefinite lengths lacks a recursion limit...

CVE-2020-28196

CVE-2020-28196 affects MIT Kerberos 5 (krb5) prior to 1.17.2 and 1.18.x prior to 1.18.3. The vulnerability stems from unbounded recursion in the ASN.1 BER decoder (lib/krb5/asn.1/asn1_encode.c) due to no recursion limit for indefinite lengths. This can lead to denial of service due to resource ex...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by multiple vulnerabilities in GNU C Library (glibc), krb5 and php

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities. Vulnerability Details Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities. Vulnerability Details: CVE-ID: CVE-2013-2207 Description: The GNU C Library...

Fedora 32 : 2:samba / krb5 (2020-939681213a)

KRB5 : - Cross-realm s4u fixes for samba 1836630 - Drop unnecessary conflict with openssl-libs = 3.0.0 - Unify kvno option documentation - Use systemctl reload to HUP the KDC during logrotate SAMBA : - Support S4U operations for Samba AD DC 1836630 - Fix lookup of users and groups when realm used...

NewStart CGSL CORE 5.04 / MAIN 5.04 : krb5 Vulnerability (NS-SA-2020-0040)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has krb5 packages installed that are affected by a vulnerability: - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 aka krb5 before 1.17. If an attacker can obtain a krbtgt ticket using an older encrypti...

NewStart CGSL MAIN 4.05 : krb5-appl Vulnerability (NS-SA-2020-0049)

The remote NewStart CGSL host, running version MAIN 4.05, has krb5-appl packages installed that are affected by a vulnerability: - utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow...

lets-chat-kerberos (>=0.2.0, <=0.4.1), passport-assistant-kerberos (0.0.1) +1 more potentially affected by CVE-2016-1000238 via node-krb5 (0.0.6)

node-krb5 NPM version 0.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on node-krb5 and may be impacted: - lets-chat-kerberos =0.2.0, =0.4.1 - passport-assistant-kerberos 0.0.1 - passport-kerberos 0.0.1 Source cves: CVE-2016-1000238 Source advisory:...

Spoofing attack due to unvalidated KDC in node-krb5

Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed indefinitely, ...

GHSA-4V9Q-HM2P-68C4 Spoofing attack due to unvalidated KDC in node-krb5

Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed indefinitely, ...

SUSE SLES12 Security Update : bind (SUSE-SU-2020:1914-1)

This update for bind fixes the following issues : Amended documentation referring to rule types 'krb5-subdomain' and 'ms-subdomain'. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. CVE-2018-5741...

SUSE SLES12 Security Update : krb5-appl (SUSE-SU-2020:1533-1)

This update for krb5-appl fixes the following issues : CVE-2020-10188: Fixed a remote root execution bsc1165787. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

SUSE-SU-2020:1533-1 Security update for krb5-appl

This update for krb5-appl fixes the following issues: - CVE-2020-10188: Fixed a remote root execution bsc1165787...

PT-2020-3071 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.6.10 Description: The issue is related to a memory leak in the Linux kernel's rpcsec gss krb5 implementation, specifically in the gss mech free function. This leak occurs when unloading a specific kernel module...

Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2020-1467)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated krb5-appl packages fix security vulnerability

Updated krb5-appl packages fix security vulnerability: A vulnerability was found where incorrect bounds checks in the telnet server’s telnetd handling of short writes and urgent data, could lead to information disclosure and corruption of heap data. An unauthenticated remote attacker could exploi...

MGASA-2020-0169 Updated krb5-appl packages fix security vulnerability

Updated krb5-appl packages fix security vulnerability: A vulnerability was found where incorrect bounds checks in the telnet server’s telnetd handling of short writes and urgent data, could lead to information disclosure and corruption of heap data. An unauthenticated remote attacker could exploi...

krb5-appl security update

1.0.1-10 - Apply previous patch - Resolves: 1814774 1.0.1-9 - Fix CVE-2020-10188 netclear/nextitem buffer overrun - Resolves: 1814774 1.0.1-8 - bump release number to sort newer than the recent 6.2 update...

Denial Of Service (DoS)

krb5 is vulnerabl eto denial of service. Multiple NULL pointer dereference and assertion failure flaws were found in the MIT Kerberos KDC when it was configured to use an LDAP Lightweight Directory Access Protocol or Berkeley Database Berkeley DB back end. A remote attacker could use these flaws ...

Denial Of Service (DoS)

krb5 is vulnerable to denial of service DoS. The vulnerability exists as multiple NULL pointer dereference and assertion failure flaws were found in the MIT Kerberos KDC when it was configured to use an LDAP Lightweight Directory Access Protocol or Berkeley Database Berkeley DB back end. A remote...

Denial Of Service (DoS)

krb5-appl is vulnerable to a buffer overflow flaw. Due to a flaw in libtelnet/encrypt.c, a remote attacker can access the telnet port of a target machine, subsequently executing arbitrary code as root...