RHEL 5 : krb5 (RHSA-2009:0408)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0408 advisory. - krb5: buffer over-read in SPNEGO GSS-API mechanism MITKRB5-SA-2009-001 CVE-2009-0844 - krb5: NULL pointer dereference in GSSAPI SPNEGO...

Fedora 9 : krb5-1.6.3-16.fc9 (2009-2834)

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism CVE-2009-0844, CVE-2009-0845, attempts to free an uninitialized pointer during protocol parsing CVE-2009-0846, and a bug in length validation during...

krb5: buffer over-read in SPNEGO GSS-API mechanism (MITKRB5-SA-2009-001)

The getinputtoken function in the SPNEGO implementation in MIT Kerberos 5 aka krb5 1.5 through 1.6.3 allows remote attackers to cause a denial of service daemon crash and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read...

krb5: NULL pointer dereference in GSSAPI SPNEGO (MITKRB5-SA-2009-001)

The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via invalid ContextFlags data in the reqFlags field in a...

krb5 security update

1.6.1-31.el53.3 - update to revised patch for CVE-2009-0844/CVE-2009-0845 1.6.1-31.el53.2 - add fix for potential buffer read overrun in the SPNEGO GSSAPI mechanism 490635, CVE-2009-0844 - add fix for NULL pointer dereference when handling certain error cases in the SPNEGO GSSAPI mechanism 490635...

Mandrake Security Advisory MDVSA-2009:082 (krb5)

The remote host is missing an update to krb5 announced via advisory MDVSA-2009:082. OpenVAS Vulnerability Test $Id: mdksa2009082.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:082 krb5 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

[ MDVSA-2009:082 ] krb5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:082 http://www.mandriva.com/security/ Package : krb5 Date : March 30, 2009 Affected: 2008.0, 2008.1, 2009.0 Problem Description: The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MI...

DEBIAN-CVE-2009-0845

The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via invalid ContextFlags data in the reqFlags field in a...

CVE-2009-0845

The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via invalid ContextFlags data in the reqFlags field in a...

CVE-2009-0845

The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via invalid ContextFlags data in the reqFlags field in a...

CVE-2009-0845

The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via invalid ContextFlags data in the reqFlags field in a...

Null pointer dereference

The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via invalid ContextFlags data in the reqFlags field in a...

CVE-2009-0845

The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via invalid ContextFlags data in the reqFlags field in a...

CVE-2009-0845

Summary of CVE-2009-0845 details from provided sources : The SPNEGO implementation in MIT Kerberos 5 (krb5) up to version 1.6.3 is affected. Specifically, in spnego_mech.c, the spnego_gss_accept_sec_context path can be triggered when SPNEGO is used with invalid ContextFlags data in a negTokenInit...

FreeBSD Ports: ethereal, ethereal-lite, tethereal, tethereal-lite

The remote host is missing an update to the system as announced in the referenced advisory. VID 74d06b67-d2cf-11d8-b479-02e0185c0b53 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

RHEL 5 : krb5 (RHSA-2008:0164)

Updated krb5 packages that resolve several issues and fix multiple bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and serve...

Critical: Red Hat Security Advisory: krb5 security and bugfix update

Updated krb5 packages that resolve several issues and fix multiple bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and serve...

CVE-2005-1935

Heap-based buffer overflow in the BERDecBitString function in Microsoft ASN.1 library MSASN1.DLL allows remote attackers to execute arbitrary code via nested constructed bit strings, which leads to a realloc of a non-null pointer and causes the function to overwrite previously freed memory, as...

CVE-2005-1935

CVE-2005-1935 documents a heap-based buffer overflow in the BERDecBitString function of Microsoft's ASN.1 library (MSASN1.DLL). The overflow occurs when processing nested constructed bit strings, leading to a realloc of a non-null pointer and potential overwrite of freed memory, demonstrated via ...

CVE-2005-0147

Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials...