FreeBSD : krb5 -- heap buffer overflow vulnerability in libkadm5srv (0bb7677d-52f3-11d9-a9e7-0001020eed82)

A MIT krb5 Security Advisory reports : The MIT Kerberos 5 administration library libkadm5srv contains a heap buffer overflow in password history handling code which could be exploited to execute arbitrary code on a Key Distribution Center KDC host. The overflow occurs during a password change of ...

Multiple MIT krb5 Kerberos 5 vulnerabilities

krb5recvauth double free problem. Buffer overflow and memory corruption in KDC...

Fedora Core 3 : krb5-1.3.6-7 (2005-552)

A double-free flaw was found in the krb5recvauth routine which may be triggered by a remote unauthenticated attacker. Fedora Core 3 contains checks within glibc that detect double-free flaws. Therefore, on Fedora Core 3, successful exploitation of this issue can only lead to a denial of service K...

Fedora Core 4 : krb5-1.4.1-5 (2005-553)

A double-free flaw was found in the krb5recvauth routine which may be triggered by a remote unauthenticated attacker. Fedora Core 4 contains checks within glibc that detect double-free flaws. Therefore, on Fedora Core 4, successful exploitation of this issue can only lead to a denial of service K...

MIT Kerberos 5 allows unauthenticated attacker to cause MIT krb5 Key Distribution Center to free unallocated memory

Overview An unauthenticated attacker can cause MIT krb5 Key Distribution Center KDC to free unallocated memory, possibly leading to arbitrary code execution. Description Kerberos is a network authentication system which uses a trusted third party a KDC to authenticate clients and servers to each...

RHEL 4 : krb5 (RHSA-2005:567)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:567 advisory. Kerberos is a networked authentication system that uses a trusted third party a KDC to authenticate clients and servers to each other. A...

MITKRB5-SA-2005-002: buffer overflow, heap corruption in KDC

-----BEGIN PGP SIGNED MESSAGE----- MIT krb5 Security Advisory 2005-002 Original release: 2005-07-12 Topic: buffer overflow, heap corruption in KDC Severity: CRITICAL SUMMARY ======= The MIT krb5 Key Distribution Center KDC implementation can corrupt the heap by attempting to free memory at a rand...

Important: Red Hat Security Advisory: krb5 security update

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Kerberos is a networked authentication system that uses a trusted third party a KDC to...

Fedora Core 2 : krb5-1.3.6-4 (2005-269)

Updated krb5 packages which fix two buffer overflow vulnerabilities in the included Kerberos-aware telnet client are now available. Kerberos is a networked authentication system which uses a trusted third-party a KDC to authenticate clients and servers to each other. The krb5-workstation package...

Kerberos configuration

This plugin lets a user enter information about the Kerberos server that will be queried by some scripts SMB and SSH to log into the remote hosts. TRUSTED...

Moderate: Red Hat Security Advisory: krb5 security update

Updated Kerberos krb5 packages that correct a buffer overflow bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Kerberos is a networked authentication system that uses a trusted third party a...

USN-58-1: MIT Kerberos server vulnerability

Michael Tautschnig discovered a possible buffer overflow in the addtohistory function in the MIT Kerberos 5 implementation. Performing a password change did not properly track the password policy's history count and the maximum number of keys. This could cause an array overflow and may have allow...

CVE-2004-0642

MIT Kerberos 5 (krb5) is affected by CVE-2004-0642 due to double-free vulnerabilities in the ASN.1 decoder error handling for both the KDC library and the krb5 client library (versions 1.3.4 and earlier). The issue can allow remote attackers to execute arbitrary code, potentially compromising the...

MIT Kerberos 5 ASN.1 decoding functions insecurely deallocate memory (double-free)

Overview The MIT Kerberos 5 library does not securely deallocate heap memory when decoding ASN.1 structures, resulting in double-free vulnerabilities. An unauthenticated, remote attacker could execute arbitrary code on a KDC server, which could compromise an entire Kerberos realm. An attacker may...

CVE-2003-0058

MIT Kerberos V5 KDC before 1.2.5 is vulnerable to remote authenticated DoS via a protocol request that triggers a null pointer dereference, causing KDC crashes within the same realm. Affected component: KDC in MIT Kerberos V5. Impact: service denial (crash) of KDCs in the realm. Root cause: null ...

MITKRB5-SA-2004-003: ASN.1 decoder denial-of-service

-----BEGIN PGP SIGNED MESSAGE----- MIT krb5 Security Advisory 2004-003 Original release: 2004-08-31 Topic: ASN.1 decoder denial of service Severity: serious SUMMARY ======= The ASN.1 decoder library in the MIT Kerberos 5 distribution is vulnerable to a denial-of-service attack causing an infinite...

Critical: Red Hat Security Advisory: krb5 security update

Updated krb5 packages that improve client responsiveness and fix several security issues are now available for Red Hat Enterprise Linux 3. Kerberos is a networked authentication system that uses a trusted third party a KDC to authenticate clients and servers to each other. Several double-free bug...

krb5 -- ASN.1 decoder denial-of-service vulnerability

An advisory published by the MIT Kerberos team says: The ASN.1 decoder library in the MIT Kerberos 5 distribution is vulnerable to a denial-of-service attack causing an infinite loop in the decoder. The KDC is vulnerable to this attack. An unauthenticated remote attacker can cause a KDC or...

krb5 -- double-free vulnerabilities

An advisory published by the MIT Kerberos team says: The MIT Kerberos 5 implementation's Key Distribution Center KDC program contains a double-free vulnerability that potentially allows a remote attacker to execute arbitrary code. Compromise of a KDC host compromises the security of the entire...

Mandrake Linux Security Advisory : krb5 (MDKSA-2003:043-1)

Multiple vulnerabilities have been found in the Kerberos network authentication system. The MIT Kerberos team have released an advisory detailing these vulnerabilities, a description of which follows. An integer signedness error in the ASN.1 decoder before version 1.2.5 allows remote attackers to...