krb5 security update

CentOS Errata and Security Advisory CESA-2010:0423 Updated krb5 packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

MIT Kerberos 5 GSS-API library DoS

NULL pointer dereference in server side code...

MITKRB5-SA-2010-005 [CVE-2010-1321] GSS-API lib null pointer deref

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2010-005 MIT krb5 Security Advisory 2010-005 Original release: 2010-05-18 Topic: GSS-API library null pointer dereference CVE-2010-1321 CVSSv2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:OF/RC:C CVSSv2 Base Score: 6.8 Access Vector: Network...

MIT Kerberos GSS-API校验和空指针引用拒绝服务漏洞

BUGTRAQ ID: 40235 CVE ID: CVE-2010-1321 Kerberos是一款广泛使用的使用强壮的加密来验证客户端和服务器端的网络协议。MIT Kerberos 5是一种常用的开源Kerberos实现。 MIT Kerberos的GSS-API库中存在空指针引用错误，通过认证的远程攻击者可以通过发送缺少校验和字段的特制GSS-API令牌来利用这个漏洞，导致使用GSS-API认证机制的服务器应用崩溃。 MIT Kerberos 5 1.8 MIT Kerberos 5 1.7 MIT Kerberos 5 1.6 厂商补丁： MIT ---...

CVE-2010-1321

The kgacceptkrb5 function in krb5/acceptseccontext.c in the GSS-API library in MIT Kerberos 5 aka krb5 through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of...

Null pointer dereference

The kgacceptkrb5 function in krb5/acceptseccontext.c in the GSS-API library in MIT Kerberos 5 aka krb5 through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of...

CVE-2010-1321

CVE-2010-1321 affects MIT Kerberos 5’s GSS-API library (krb5) in kg_accept_krb5/accept_sec_context.c. The flaw permits remote authenticated users to cause a denial of service via an AP-REQ with a missing authenticator checksum, triggering a NULL pointer dereference and daemon crash. Affected are ...

CVE-2010-1321

The kgacceptkrb5 function in krb5/acceptseccontext.c in the GSS-API library in MIT Kerberos 5 aka krb5 through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of...

CVE-2010-1321

The kgacceptkrb5 function in krb5/acceptseccontext.c in the GSS-API library in MIT Kerberos 5 aka krb5 through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of...

MIT Kerberos GSS-API Library Remote Denial of Service Vulnerability

MIT Kerberos contains a vulnerability that could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is in the GSS-API acceptor component due to lack of pointer validation. An authenticated, remote attacker could exploit the vulnerability by makin...

RHEL 5 : krb5 (RHSA-2010:0343)

Updated krb5 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

FreeBSD Ports: krb5

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: krb5

The remote host is missing an update to the system as announced in the referenced advisory. VID 86b8b655-4d1a-11df-83fb-0015587e2cc1 OpenVAS Vulnerability Test $ Description: Auto generated from VID 86b8b655-4d1a-11df-83fb-0015587e2cc1 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

MIT Kerberos 5 double free()

KDC double free...

MITKRB5-SA-2010-004 [CVE-2010-1320] double free in KDC

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2010-004 MIT krb5 Security Advisory 2010-004 Original release: 2010-04-20 Topic: double free in KDC CVE-2010-1320 CVSSv2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2 Base Score: 9 Access Vector: Network Access Complexity: Low...

CVE-2010-1320

Double free vulnerability in dotgsreq.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service daemon crash or possibly execute arbitrary code via a request associated with 1 renewal or 2 validation...

Double free

Double free vulnerability in dotgsreq.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service daemon crash or possibly execute arbitrary code via a request associated with 1 renewal or 2 validation...

CVE-2010-1320

Double free vulnerability in dotgsreq.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service daemon crash or possibly execute arbitrary code via a request associated with 1 renewal or 2 validation...

CVE-2010-1320

CVE-2010-1320: MIT Kerberos 5 is affected by a double-free in do_tgs_req.c (KDC) that allows remote authenticated users to cause a daemon crash or potentially execute arbitrary code. Affected: krb5 1.7.x and 1.8.x before 1.8.2. Impact: denial of service or possible code execution via a renewal/va...

CVE-2010-1320

Double free vulnerability in dotgsreq.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service daemon crash or possibly execute arbitrary code via a request associated with 1 renewal or 2 validation...