GLSA-200803-31 : MIT Kerberos 5: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-31 MIT Kerberos 5: Multiple vulnerabilities Two vulnerabilities were found in the Kerberos 4 support in KDC: A global variable is not set for some incoming message types, leading to a NULL pointer dereference or a double fr...

MIT Kerberos 5: Multiple vulnerabilities

Background MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. kadmind is the MIT Kerberos 5 administration daemon, KDC is the Key Distribution Center. Description Two vulnerabilities were found in the Kerberos 4 support in KDC: A global variable is not set for...

Debian DSA-1524-1 : krb5 - several vulnerabilities

Several remote vulnerabilities have been discovered in the kdc component of the krb5, a system for authenticating users and services on a network. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0062 An unauthenticated remote attacker may cause a...

krb5 security update

CentOS Errata and Security Advisory CESA-2008:0180 Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication...

MIT Kerberos 5 KDC多个内存破坏信息泄露漏洞

BUGTRAQ ID: 28303 CVECAN ID: CVE-2008-0062,CVE-2008-0063 Kerberos是一款广泛使用的使用强壮的加密来验证客户端和服务器端的网络协议。MIT Kerberos 5是一种常用的开源Kerberos实现。 Kerberos 5的实现上存在两个漏洞，远程攻击者可能利用此漏洞导致拒绝服务或获取敏感信息。 如果Kerberos 5 KDC中启用了Kerberos 4支持的话，发送畸形消息可能会触发两个漏洞： CVE-2008-0062：如果KDC接收到了畸形的Kerberos 4消息的话，且之前没有Kerberos...

Stack overflow

The Kerberos 4 support in KDC in MIT Kerberos 5 krb5kdc does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."...

CVE-2008-0062

KDC in MIT Kerberos 5 krb5kdc does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free...

CVE-2008-0063

The Kerberos 4 support in KDC in MIT Kerberos 5 krb5kdc does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."...

Double free

KDC in MIT Kerberos 5 krb5kdc does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free...

CVE-2008-0062

KDC in MIT Kerberos 5 krb5kdc does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free...

CVE-2008-0063

The Kerberos 4 support in KDC in MIT Kerberos 5 krb5kdc does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."...

CVE-2008-0062

KDC in MIT Kerberos 5 krb5kdc does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free...

CVE-2008-0063

CVE-2008-0063 affects MIT Kerberos 5 (krb5kdc) where Kerberos v4 support leaves an unused buffer uncleared when generating error messages. This can allow remote attackers to read sensitive information from memory. Public advisories across multiple vendors (e.g., MiracleLinux AXSA-2008-345/AXSA-20...

CVE-2008-0062

KDC in MIT Kerberos 5 krb5kdc does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free...

CVE-2008-0062

MIT Kerberos 5 krb5kdc is affected by CVE-2008-0062 (and related CVEs) where the KDC may crash or possibly allow remote code execution via crafted Kerberos v4 messages, due to not initializing a global variable which can cause a NULL pointer dereference or a double-free. This results in denial of...

krb5 security update

CentOS Errata and Security Advisory CESA-2008:0164 Updated krb5 packages that resolve several issues and fix multiple bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network...

MIT Kerberos krb4-enabled KDC contains multiple vulnerabilities

Overview Vulnerabilities in the MIT Kerberos Key Distribution Center server could allow a remote attacker to compromise the key database, gain access to sensitive information, or cause a denial of service. Description Several vulnerabilities exist in the Authentication Service and Key Distributio...

krb5 security update

CentOS Errata and Security Advisory CESA-2008:0181 Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network...

Critical: Red Hat Security Advisory: krb5 security and bugfix update

Updated krb5 packages that resolve several issues and fix multiple bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and serve...

Critical: Red Hat Security Advisory: krb5 security update

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.5 Extended Update Support. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients...