krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005)

The kgacceptkrb5 function in krb5/acceptseccontext.c in the GSS-API library in MIT Kerberos 5 aka krb5 through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of...

Threat Outbreak Alert: Fake DHL Package Delivery Notification Email Messages on March 20, 2015

Medium Alert ID: 23104 First Published: 2011 May 9 12:53 GMT Last Updated: 2015 March 20 12:50 GMT Version: 13 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a DHL package delivery notification. The text in the email message instructs...

Design/Logic Flaw

Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors...

CVE-2010-4803

Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors...

SuSE 11.1 Security Update : dhcpcd (SAT Patch Number 4389)

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. CVE-2011-0996 Note this update is...

GOM Player 2.1.28.5039 - AVI Denial of Service (PoC)

GOM Player 2.1.28.5039 - AVI Denial of Service PoC done by BraniX www.hackers.org.pl found: 2011.03.29 published: 2011.03.29 tested on: Windows XP SP3 Home Edition App: GOM Player 2.1.28.5039 App Url: http://download.cnet.com/GOM-Media-Player/3000-136324-10551786.html GOM.exe MD5:...

Fedora 13 : samba-3.5.8-74.fc13 (2011-3120)

Tue Mar 8 2011 Guenther Deschner - 3.5.8-74 - Update to 3.5.8 - resolves: 617482 - Thu Mar 3 2011 Guenther Deschner - 3.5.7-73 - Security update to 3.5.7 to address CVE-2011-0719 - resolves: 681852 - Thu Jan 6 2011 Guenther Deschner - 3.5.6-72 - Fix GSSAPI checksum for some SMB servers -...

CVE-2011-1073

crontab.c in crontab in FreeBSD and Apple Mac OS X allows local users to 1 determine the existence of arbitrary files via a symlink attack on a /tmp/crontab.XXXXXXXXXX temporary file and 2 perform MD5 checksum comparisons on arbitrary pairs of files via two symlink attacks on...

CVE-2011-1073

CVE-2011-1073 affects the crontab component of FreeBSD and Apple macOS. The vulnerability arises from two symlink attacks against temporary files named /tmp/crontab.XXXXXXXXXX, enabling a local user to (1) determine the existence of arbitrary files and (2) perform MD5 checksum comparisons on arbi...

CVE-2011-1073

crontab.c in crontab in FreeBSD and Apple Mac OS X allows local users to 1 determine the existence of arbitrary files via a symlink attack on a /tmp/crontab.XXXXXXXXXX temporary file and 2 perform MD5 checksum comparisons on arbitrary pairs of files via two symlink attacks on...

CVE-2011-1073

crontab.c in crontab in FreeBSD and Apple Mac OS X allows local users to 1 determine the existence of arbitrary files via a symlink attack on a /tmp/crontab.XXXXXXXXXX temporary file and 2 perform MD5 checksum comparisons on arbitrary pairs of files via two symlink attacks on...

CVE-2011-0043

Kerberos in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 supports weak hashing algorithms, which allows local users to gain privileges by operating a service that sends crafted service tickets, as demonstrated by the CRC32 algorithm, aka "Kerberos Unkeyed Checksum Vulnerability."...

Microsoft Windows Kerberos Unkeyed Checksum Local Privilege Escalation Vulnerability

Description The Microsoft Windows implementation of Kerberos is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting these issues will result in the complete compromise of affect...

FreeBSD Ports: krb5

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005)

The kgacceptkrb5 function in krb5/acceptseccontext.c in the GSS-API library in MIT Kerberos 5 aka krb5 through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of...

krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005)

The kgacceptkrb5 function in krb5/acceptseccontext.c in the GSS-API library in MIT Kerberos 5 aka krb5 through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of...

[SECURITY] [DSA 2132-1] New xulrunner packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-2132-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 11, 2010 http://www.debian.org/security/faq -...

FreeBSD : krb5 -- RFC 3961 key-derivation checksum handling vulnerability (1d193bba-03f6-11e0-bf50-001a926c7637)

The MIT Kerberos team reports : MIT krb5 releases incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH and AD-KDC-ISSUED authorization data. An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the...

FreeBSD : krb5 -- unkeyed PAC checksum handling vulnerability (9f971cea-03f5-11e0-bf50-001a926c7637)

The MIT Kerberos team reports : MIT krb5 incorrectly accepts an unkeyed checksum for PAC signatures. An authenticated remote attacker can forge PACs if using a KDC that does not filter client-provided PAC data. This can result in privilege escalation against a service that relies on PAC contents ...

FreeBSD : krb5 -- multiple checksum handling vulnerabilities (0d57c1d9-03f4-11e0-bf50-001a926c7637)

The MIT Kerberos team reports : MIT krb incorrectly accepts an unkeyed checksum with DES session keys for version 2 RFC 4121 of the GSS-API krb5 mechanism. An unauthenticated remote attacker can forge GSS tokens that are intended to be integrity-protected but unencrypted, if the targeted...