3734 matches found
CVE-2012-1015
The kdchandleprotectednegotiation function in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.8.x, 1.9.x before 1.9.5, and 1.10.x before 1.10.3 attempts to calculate a checksum before verifying that the key type is appropriate for a checksum, which allows remote attackers to execute...
CVE-2012-1015
CVE-2012-1015 affects MIT Kerberos 5 (krb5) in KDC handling: 1.8.x, 1.9.x before 1.9.5, and 1.10.x before 1.10.3. The issue arises when kdc_handle_protected_negotiation calculates a checksum before verifying that the key type is appropriate, enabling a remote attacker to cause arbitrary code exec...
CVE-2012-1014
CVE-2012-1014 – MIT Kerberos 5 (krb5) : The KDC’s process_as_req in krb5 1.10.x before 1.10.3 fails to initialize a structure member, enabling an uninitialized pointer dereference that can cause denial of service or potentially allow code execution via a malformed AS-REQ. Public details in connec...
CVE-2012-1014
The processasreq function in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service uninitialized pointer dereference and daemon crash or possibly execute arbitrary...
MITKRB5-SA-2012-001: KDC heap corruption and crash [CVE-2012-1014 CVE-2012-1015]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2012-001 MIT krb5 Security Advisory 2012-001 Original release: 2012-07-31 Topic: KDC heap corruption and crash vulnerabilities CVE-2012-1015: KDC frees uninitialized pointer CVSSv2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2...
MIT Kerberos 5 security vulnerabilities
Uninitialized pointer free, DoS...
Mandriva Update for krb5 MDVSA-2012:120 (krb5)
Check for the Version of krb5 OpenVAS Vulnerability Test Mandriva Update for krb5 MDVSA-2012:120 krb5 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...
Ubuntu Update for krb5 USN-1520-1
Ubuntu Update for Linux kernel vulnerabilities USN-1520-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN15201.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for krb5 USN-1520-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...
Scientific Linux Security Update : krb5 on SL6.x i386/x86_64 (20120731)
Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center KDC. An uninitialized pointer use flaw was found in the way the MIT Kerberos KDC handled initial...
Important: krb5
Issue Overview: An uninitialized pointer use flaw was found in the way the MIT Kerberos KDC handled initial authentication requests AS-REQ. A remote, unauthenticated attacker could use this flaw to crash the KDC via a specially-crafted AS-REQ request. CVE-2012-1015 A NULL pointer dereference flaw...
Mandriva Update for krb5 MDVSA-2012:120 (krb5)
The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...
Scientific Linux Security Update : krb5 on SL3.x i386/x86_64
An input validation flaw was found in the ASN.1 Abstract Syntax Notation One decoder used by MIT Kerberos. A remote attacker could use this flaw to crash a network service using the MIT Kerberos library, such as kadmind or krb5kdc, by causing it to dereference or free an uninitialized pointer or,...
Scientific Linux Security Update : krb5 on SL5.x i386/x86_64
A NULL pointer dereference flaw was found in the way the MIT Kerberos KDC processed principal names that were not null terminated, when the KDC was configured to use an LDAP back end. A remote attacker could use this flaw to crash the KDC via a specially crafted request. CVE-2011-0282 A denial of...
Scientific Linux Security Update : krb5 on SL6.x i386/x86_64
An invalid free flaw was found in the password-changing capability of the MIT Kerberos administration daemon, kadmind. A remote, unauthenticated attacker could use this flaw to cause kadmind to abort via a specially crafted request. CVE-2011-0285 After installing the updated packages, the kadmind...
Scientific Linux Security Update : krb5 on SL3.x, SL4.x, SL5.x i386/x86_64
A NULL pointer dereference flaw was discovered in the MIT Kerberos Generic Security Service Application Program Interface GSS-API library. A remote, authenticated attacker could use this flaw to crash any server application using the GSS-API authentication mechanism, by sending a specially crafte...
Scientific Linux Security Update : krb5 on SL6.x i386/x86_64
An uninitialized pointer use flaw was found in the way the MIT Kerberos KDC handled TGS Ticket-granting Server request messages. A remote, authenticated attacker could use this flaw to crash the KDC or, possibly, disclose KDC memory or execute arbitrary code with the privileges of the KDC krb5kdc...
Scientific Linux Security Update : xorg-x11 on SL4.x i386/x86_64
An input validation flaw was discovered in X.org's Security and Record extensions. A malicious authorized client could exploit this issue to cause a denial of service crash or, potentially, execute arbitrary code with root privileges on the X.Org server. CVE-2008-1377 Multiple integer overflow...
Scientific Linux Security Update : krb5 on SL4.x, SL5.x i386/x86_64
Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third- party, the Key Distribution Center KDC. A buffer overflow flaw was found in the MIT krb5 telnet daemon telnetd. A remote attacker who can acce...
Scientific Linux Security Update : xorg-x11-server on SL5.x i386/x86_64
An input validation flaw was discovered in X.org's Security and Record extensions. A malicious authorized client could exploit this issue to cause a denial of service crash or, potentially, execute arbitrary code with root privileges on the X.Org server. CVE-2008-1377 Multiple integer overflow...
Scientific Linux Security Update : krb5 on SL4.x, SL5.x i386/x86_64
Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms...