Oracle Linux 7 : krb5 (ELSA-2015-0439)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0439 advisory. - fix for CVE-2014-5352 1179856 'gssprocesscontexttoken incorrectly frees context MITKRB5-SA-2015-001' - fix for CVE-2014-9421 1179857 'kadmind doubly...

Fedora Update for krb5 FEDORA-2015-2347

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 21 : krb5-1.12.2-14.fc21 (2015-2347)

Security fix for CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introduci...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

krb5 security, bug fix and enhancement update

1.12.2-14 - fix for kinit -C loops 1184629, MIT/krb5 issue 243, 'Do not loop on principal unknown errors'. 1.12.2-13 - fix for CVE-2014-5352 1179856 'gssprocesscontexttoken incorrectly frees context MITKRB5-SA-2015-001' - fix for CVE-2014-9421 1179857 'kadmind doubly frees partial deserialization...

Fedora 20 : krb5-1.11.5-18.fc20 (2015-2382)

Security fix for CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423 Security fix for CVE-2014-5351 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as muc...

Fedora Update for krb5 FEDORA-2015-2382

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for krb5 RHSA-2015:0439-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : krb5 (RHSA-2015:0439)

Updated krb5 packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

FreeBSD : krb5 1.11 -- New release/fix multiple vulnerabilities (dbf9e66c-bd50-11e4-a7ba-206a8a720317)

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6 : Handle certain invalid RFC 1964 GSS tokens correctly to avoid invalid memory reference vulnerabilities. CVE-2014-4341 Fix memory management vulnerabilities in GSSAPI SPNEGO. CVE-2014-4343 CVE-2014-4344 Fix buffer...

Null pointer dereference

MIT Kerberos 5 aka krb5 through 1.13.1 incorrectly expects that a krb5readmessage data field is represented as a string ending with a '\0' character, which allows remote attackers to 1 cause a denial of service NULL pointer dereference via a zero-byte version string or 2 cause a denial of service...

CVE-2014-5355

Summary: CVE-2014-5355 affects MIT Kerberos 5 (krb5) where krb5_read_message() mis-handles input, causing a NULL pointer dereference with a zero-byte version string and an out-of-bounds read when the string is not null-terminated. Connected advisories indicate this was fixed in upstream krb5 (e.g...

CVE-2014-5352

The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...

CVE-2014-5352

Summary: CVE-2014-5352 affects MIT Kerberos libgssapi_krb5 (krb5) where gss_process_context_token can mishandle security-context handles, enabling remote authenticated users to cause denial of service (use-after-free/double-free) or potentially execute code via crafted GSSAPI traffic (demonstrate...

krb5: multiple issues

CVE-2014-5352 authenticated remote code execution: In the MIT krb5 libgssapikrb5 library, after gssprocesscontexttoken is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in...

Updated krb5 packages fix security vulnerabilities

Updated krb5 packages fix security vulnerabilities: Incorrect memory management in the libgssapikrb5 library might result in denial of service or the execution of arbitrary code CVE-2014-5352. Incorrect memory management in kadmind's processing of XDR data might result in denial of service or the...

MGASA-2015-0066 Updated krb5 packages fix security vulnerabilities

Updated krb5 packages fix security vulnerabilities: Incorrect memory management in the libgssapikrb5 library might result in denial of service or the execution of arbitrary code CVE-2014-5352. Incorrect memory management in kadmind's processing of XDR data might result in denial of service or the...

FreeBSD : krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 (3a888a1e-b321-11e4-83b2-206a8a720317)

The MIT Kerberos team reports : CVE-2014-5353: The krb5ldapgetpasswordpolicyfromdn function in plugins/kdb/ldap/libkdbldap/ldappwdpolicy.c in MIT Kerberos 5 aka krb5 before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service daemon crash via a successful...

openSUSE Security Update : krb5 (openSUSE-2015-128)

krb5 was updated to fix five security issues. These security issues were fixed : - CVE-2014-5351: current keys returned when randomizing the keys for a service principal bnc897874 - CVE-2014-5352: An authenticated attacker could cause a vulnerable application including kadmind to crash or to...

SuSE 11.3 Security Update : krb5 (SAT Patch Number 10282)

krb5 has been updated to fix four security issues : - gssprocesscontexttoken incorrectly frees context bsc912002. CVE-2014-5352 - kadmind doubly frees partial deserialization results bsc912002. CVE-2014-9421 - kadmind incorrectly validates server principal name bsc912002. CVE-2014-9422 - libgssrp...