CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

Heimdal man-in-the-middle attack vulnerability

Heimdal is a Kerberos 5 implementation. A security vulnerability in the krb5initcredsstep file in lib/krb5/initcredspw.c in versions of Heimdal prior to 7.6.0 stems from the program failing to validate a change to the PA-PKINIT-KX key when an anonymous PKINIT is used. An attacker could exploit th...

Denial Of Service (DoS)

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center KDC. When a client attempts to use PKINIT to obtain credentials from the KDC, the client can specify, using ...

Denial Of Service (DoS)

krb5 is vulnerable to denial of service DoS attacks. The vulnerability exists as the pkinitserverreturnpadata function in plugins/preauth/pkinit/pkinitsrv.c in the PKINIT implementation in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.10.4 attempts to find an agility KDF...

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:4066-1)

This update for samba fixes the following issues : Update to samba version 4.7.11. Security issues fixed : CVE-2018-14629: Fixed CNAME loops in Samba AD DC DNS server bsc1116319. CVE-2018-16841: Fixed segfault on PKINIT when mis-matching principal bsc1116320. CVE-2018-16851: Fixed NULL pointer...

Double-free in Samba AD DC KDC with PKINIT

Description When configured to accept smart-card authentication, Samba's KDC will call tallocfree twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is...

Scientific Linux Security Update : krb5 on SL7.x x86_64 (20181030)

Security Fixes : - krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data CVE-2018-5729 - krb5: DN container check bypass by supplying special crafted data CVE-2018-5730 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

krb5 security, bug fix, and enhancement update

1.15.1-34 - In FIPS mode, add plaintext fallback for RC4 usages and taint - Resolves: 1570600 1.15.1-33 - Use SHA-256 instead of MD5 for audit ticket IDs - Resolves: 1570600 1.15.1-32 - Include preauth name in trace output if possible - Update cert generation scripts to work on modern openssl - F...

krb5 security, bug fix, and enhancement update

1.15.1-18 - Expose context errors in pkinitserverplugininit - Resolves: 1460089 1.15.1-17 - Drop certauth test changes that prevented runnig it - Resolves: 1498767 1.15.1-16 - Drop irrelevant DIR trigger logic - Resolves: 1431198 1.15.1-15 - Fix CVE-2017-7562 certauth eku bypass - Resolves: 14987...

CVE-2017-15088

A stack based buffer overflow was found in the getmatchingdata function, when reading the principal's certificate during pkinit preauthentication. If the Certifcate Authority's subject line is sufficiently long, an attacker able to have a specially crafted certificate signed could crash the...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information

The multiple vulnerabilities in the krb5-pkinit package of the Debian GNU/Linux operating system may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

krb5 security update

CentOS Errata and Security Advisory CESA-2015:2154 Updated krb5 packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerabili...

Oracle Linux 7 : krb5 (ELSA-2015-2154)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2154 advisory. - the rebase to krb5 1.13.1 in vers 1.13.1-0 also fixed: - Bug 1144498 'Fix the race condition in the libkrb5 replay cache' - Bug 1163402 'kdb5ldaputil...

Oracle: Security Advisory (ELSA-2013-0656)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

krb5: multiple issues

CVE-2014-5355 denial of service When a server process uses the krb5recvauth function, an unauthenticated remote attacker can cause a NULL dereference by sending a zero-byte version string, or a read beyond the end of allocated storage by sending a non-null-terminated version string. The example...

lib32-krb5: multiple issues

CVE-2014-5355 denial of service When a server process uses the krb5recvauth function, an unauthenticated remote attacker can cause a NULL dereference by sending a zero-byte version string, or a read beyond the end of allocated storage by sending a non-null-terminated version string. The example...

krb5 -- requires_preauth bypass in PKINIT-enabled KDC

MIT reports: In MIT krb5 1.12 and later, when the KDC is configured with PKINIT support, an unauthenticated remote attacker can bypass the requirespreauth flag on a client principal and obtain a ciphertext encrypted in the principal's long-term key. This ciphertext could be used to conduct an...

Vulnerabilities of the CentOS operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The krb5-pkinit-openssl-1.9 package on the CentOS operating system has multiple vulnerabilities. Exploitation of these vulnerabilities can lead to violations of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities in the SUSE Linux Enterprise operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities of the krb5-plugin-preauth-pkinit-debuginfo package in the SUSE Linux Enterprise operating system can lead to breaches of confidentiality, integrity, and accessibility of protected information. Exploitation of these vulnerabilities can be carried out remotely...