CVE-2014-5353

The krb5ldapgetpasswordpolicyfromdn function in plugins/kdb/ldap/libkdbldap/ldappwdpolicy.c in MIT Kerberos 5 aka krb5 before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service daemon crash via a successful LDAP query with no results, as demonstrated by...

OracleVM 2.2 : krb5 (OVMSA-2011-0015)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix for CVE-2011-4862 - incorporate a fix to teach the file labeling bits about when replay caches are expunged 712453 - rebuild - ftp: handle larger command inputs 665833 - don't bail halfway through...

OracleVM 2.1 : krb5 (OVMSA-2009-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-0844 The getinputtoken function in the SPNEGO implementation in MIT Kerberos 5 aka krb5 1.5 through 1.6.3 allows remote attackers to cause a denial of service daemon crash and possibly obtain...

OracleVM 3.3 : krb5 (OVMSA-2014-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - actually apply that last patch - incorporate fix for MITKRB5-SA-2014-001 CVE-2014-4345, 1128157 - ksu: when evaluating .k5users, don't throw away data from .k5users when we're not passed a command to...

[ MDVSA-2014:224 ] krb5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:224 http://www.mandriva.com/en/support/security/ Package : krb5 Date : November 21, 2014 Affected: Business Server 1.0 Problem Description: Updated krb5 packages fix security vulnerability: The...

MIT krb5 privilege escalation

Under some conditions, kadm5randkeyprincipal3 returns old keys...

Mandriva Linux Security Advisory : krb5 (MDVSA-2014:224)

Updated krb5 packages fix security vulnerability : The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by...

MGASA-2014-0477 Updated krb5 packages fix security vulnerability

The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access CVE-2014-5351...

Updated krb5 packages fix security vulnerability

The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access CVE-2014-5351...

Amazon Linux AMI : krb5 (ALAS-2014-443)

It was found that if a KDC served multiple realms, certain requests could cause the setupserverrealm function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request. CVE-2013-1418 , CVE-2013-6800 A NULL pointer...

SuSE 11.3 Security Update : krb5 (SAT Patch Number 9827)

This update for krb5 fixes the following issues : - When randomizing the keys for a service principal, current keys could be returned. CVE-2014-5351 - klist -s crashes when handling multiple referral entries. bnc890623 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

CentOS 6 : krb5 (CESA-2014:1389)

Updated krb5 packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings,...

Scientific Linux Security Update : krb5 on SL6.x i386/x86_64 (20141014)

It was found that if a KDC served multiple realms, certain requests could cause the setupserverrealm function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request. CVE-2013-1418, CVE-2013-6800 A NULL pointer...

Security fix for the ALT Linux 9 package krb5 version 1.13-alt1

Oct. 31, 2014 Alexey Shabalin 1.13-alt1 - 1.13 - fixed CVE-2014-5351 - move header from /usr/include/krb5 to /usr/include - drop kdcrotate service - update krb5.conf: + add logging example + add realms example + add domainrealm example + define defaultccachename as KEYRING:persistent:%uid...

Security fix for the ALT Linux 7 package krb5 version 1.13-alt1

Oct. 31, 2014 Alexey Shabalin 1.13-alt1 - 1.13 - fixed CVE-2014-5351 - move header from /usr/include/krb5 to /usr/include - drop kdcrotate service - update krb5.conf: + add logging example + add realms example + add domainrealm example + define defaultccachename as KEYRING:persistent:%uid...

Security fix for the ALT Linux 8 package krb5 version 1.13-alt1

Oct. 31, 2014 Alexey Shabalin 1.13-alt1 - 1.13 - fixed CVE-2014-5351 - move header from /usr/include/krb5 to /usr/include - drop kdcrotate service - update krb5.conf: + add logging example + add realms example + add domainrealm example + define defaultccachename as KEYRING:persistent:%uid...

Security fix for the ALT Linux 7 package openssl10 version 1.0.1j-alt1

Oct. 30, 2014 Gleb Fotengauer-Malinovskiy 1.0.1j-alt1 - Updated to 1.0.1j fixes CVE-2014-3512, CVE-2014-3511, CVE-2014-3510, CVE-2014-3507, CVE-2014-3506, CVE-2014-3505, CVE-2014-3509, CVE-2014-5139, CVE-2014-3508, CVE-2014-3513, CVE-2014-3567, CVE-2014-3566, CVE-2014-3568. - Updated patches from...

krb5 security update

CentOS Errata and Security Advisory CESA-2014:1389 Updated krb5 packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS...

Oracle Linux 6 : krb5 (ELSA-2014-1389)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1389 advisory. - incorporate fix for MITKRB5-SA-2014-001 CVE-2014-4345, 1128157 - gssapi: pull in upstream fix for a possible NULL dereference in spnego CVE-2014-4344...

RedHat Update for krb5 RHSA-2014:1389-02

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...