RHSA-2015:0439 - Vulnerability-Lookup

RHSA-2015:0439

Vulnerability from csaf_opensuse - Published: 2015-03-05 00:00 - Updated: 2026-09-20 10:54

Summary

security update for krb5

Severity

Moderate

Notes

Title of the patch: security update for krb5

Description of the patch: This security update provides a functional equivalent of RHSA-2015:0439. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2015:0439.

Patchnames: RHSA-2015:0439

Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

CVE-2014-4341

Affected products

Recommended 8 products

Product	Identifier	Version	Remediation
Unresolved product id: SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686		—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64		—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686		—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64		—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64		—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64		—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64		—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2014-4342

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact moderate

CVE-2014-4343

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact moderate

CVE-2014-4344

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact moderate

CVE-2014-4345

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact moderate

CVE-2014-5352

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact moderate

CVE-2014-5353

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact low

CVE-2014-9421

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact moderate

CVE-2014-9422

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact moderate

CVE-2014-9423

Affected products

Recommended 8 products, the same list as for CVE-2014-4341

Threats

Impact moderate

References

43 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2014-4341/	self
https://www.suse.com/security/cve/CVE-2014-4342/	self
https://www.suse.com/security/cve/CVE-2014-4343/	self
https://www.suse.com/security/cve/CVE-2014-4344/	self
https://www.suse.com/security/cve/CVE-2014-4345/	self
https://www.suse.com/security/cve/CVE-2014-5352/	self
https://www.suse.com/security/cve/CVE-2014-5353/	self
https://www.suse.com/security/cve/CVE-2014-9421/	self
https://www.suse.com/security/cve/CVE-2014-9422/	self
https://www.suse.com/security/cve/CVE-2014-9423/	self
https://www.suse.com/security/cve/CVE-2014-4341	external
https://bugzilla.suse.com/770172	external
https://bugzilla.suse.com/886016	external
https://www.suse.com/security/cve/CVE-2014-4342	external
https://bugzilla.suse.com/770172	external
https://bugzilla.suse.com/886016	external
https://www.suse.com/security/cve/CVE-2014-4343	external
https://bugzilla.suse.com/770172	external
https://bugzilla.suse.com/888697	external
https://www.suse.com/security/cve/CVE-2014-4344	external
https://bugzilla.suse.com/888697	external
https://www.suse.com/security/cve/CVE-2014-4345	external
https://bugzilla.suse.com/770172	external
https://bugzilla.suse.com/891082	external
https://www.suse.com/security/cve/CVE-2014-5352	external
https://bugzilla.suse.com/1005509	external
https://bugzilla.suse.com/770172	external
https://bugzilla.suse.com/912002	external
https://www.suse.com/security/cve/CVE-2014-5353	external
https://bugzilla.suse.com/910457	external
https://www.suse.com/security/cve/CVE-2014-9421	external
https://bugzilla.suse.com/1005509	external
https://bugzilla.suse.com/770172	external
https://bugzilla.suse.com/912002	external
https://www.suse.com/security/cve/CVE-2014-9422	external
https://bugzilla.suse.com/1005509	external
https://bugzilla.suse.com/770172	external
https://bugzilla.suse.com/912002	external
https://www.suse.com/security/cve/CVE-2014-9423	external
https://bugzilla.suse.com/1005509	external
https://bugzilla.suse.com/912002	external

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for krb5",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2015:0439.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2015:0439.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2015:0439",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2015_0439.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-4341 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-4341/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-4342 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-4342/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-4343 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-4343/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-4344 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-4344/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-4345 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-4345/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-5352 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-5352/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-5353 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-5353/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9421 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9421/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9422 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9422/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9423 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9423/"
      }
    ],
    "title": "security update for krb5",
    "tracking": {
      "current_release_date": "2026-09-20T10:54:00Z",
      "generator": {
        "date": "2015-03-05T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2015:0439",
      "initial_release_date": "2015-03-05T00:00:00Z",
      "revision_history": [
        {
          "date": "2015-03-05T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T10:54:00Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "krb5-devel-0:1.12.2-14.el7.i686",
                "product": {
                  "name": "krb5-devel-0:1.12.2-14.el7.i686",
                  "product_id": "krb5-devel-0:1.12.2-14.el7.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/krb5-devel@1.12.2-14.el7?arch=i686\u0026upstream=krb5-0:1.12.2-14.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "krb5-libs-0:1.12.2-14.el7.i686",
                "product": {
                  "name": "krb5-libs-0:1.12.2-14.el7.i686",
                  "product_id": "krb5-libs-0:1.12.2-14.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/krb5-libs@1.12.2-14.el7?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "krb5-devel-0:1.12.2-14.el7.x86_64",
                "product": {
                  "name": "krb5-devel-0:1.12.2-14.el7.x86_64",
                  "product_id": "krb5-devel-0:1.12.2-14.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/krb5-devel@1.12.2-14.el7?arch=x86_64\u0026upstream=krb5-0:1.12.2-14.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "krb5-libs-0:1.12.2-14.el7.x86_64",
                "product": {
                  "name": "krb5-libs-0:1.12.2-14.el7.x86_64",
                  "product_id": "krb5-libs-0:1.12.2-14.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/krb5-libs@1.12.2-14.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "krb5-pkinit-0:1.12.2-14.el7.x86_64",
                "product": {
                  "name": "krb5-pkinit-0:1.12.2-14.el7.x86_64",
                  "product_id": "krb5-pkinit-0:1.12.2-14.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/krb5-pkinit@1.12.2-14.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "krb5-server-0:1.12.2-14.el7.x86_64",
                "product": {
                  "name": "krb5-server-0:1.12.2-14.el7.x86_64",
                  "product_id": "krb5-server-0:1.12.2-14.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/krb5-server@1.12.2-14.el7?arch=x86_64\u0026upstream=krb5-0:1.12.2-14.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "krb5-server-ldap-0:1.12.2-14.el7.x86_64",
                "product": {
                  "name": "krb5-server-ldap-0:1.12.2-14.el7.x86_64",
                  "product_id": "krb5-server-ldap-0:1.12.2-14.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/krb5-server-ldap@1.12.2-14.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "krb5-workstation-0:1.12.2-14.el7.x86_64",
                "product": {
                  "name": "krb5-workstation-0:1.12.2-14.el7.x86_64",
                  "product_id": "krb5-workstation-0:1.12.2-14.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/krb5-workstation@1.12.2-14.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7",
                "product": {
                  "name": "SUSE Liberty Linux 7",
                  "product_id": "SUSE Liberty Linux 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "krb5-devel-0:1.12.2-14.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686"
        },
        "product_reference": "krb5-devel-0:1.12.2-14.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "krb5-devel-0:1.12.2-14.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64"
        },
        "product_reference": "krb5-devel-0:1.12.2-14.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "krb5-libs-0:1.12.2-14.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686"
        },
        "product_reference": "krb5-libs-0:1.12.2-14.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "krb5-libs-0:1.12.2-14.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64"
        },
        "product_reference": "krb5-libs-0:1.12.2-14.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "krb5-pkinit-0:1.12.2-14.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64"
        },
        "product_reference": "krb5-pkinit-0:1.12.2-14.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "krb5-server-0:1.12.2-14.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64"
        },
        "product_reference": "krb5-server-0:1.12.2-14.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "krb5-server-ldap-0:1.12.2-14.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64"
        },
        "product_reference": "krb5-server-ldap-0:1.12.2-14.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "krb5-workstation-0:1.12.2-14.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        },
        "product_reference": "krb5-workstation-0:1.12.2-14.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-4341",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-4341"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-4341",
          "url": "https://www.suse.com/security/cve/CVE-2014-4341"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 770172 for CVE-2014-4341",
          "url": "https://bugzilla.suse.com/770172"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 886016 for CVE-2014-4341",
          "url": "https://bugzilla.suse.com/886016"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-4341"
    },
    {
      "cve": "CVE-2014-4342",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-4342"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-4342",
          "url": "https://www.suse.com/security/cve/CVE-2014-4342"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 770172 for CVE-2014-4342",
          "url": "https://bugzilla.suse.com/770172"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 886016 for CVE-2014-4342",
          "url": "https://bugzilla.suse.com/886016"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-4342"
    },
    {
      "cve": "CVE-2014-4343",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-4343"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-4343",
          "url": "https://www.suse.com/security/cve/CVE-2014-4343"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 770172 for CVE-2014-4343",
          "url": "https://bugzilla.suse.com/770172"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 888697 for CVE-2014-4343",
          "url": "https://bugzilla.suse.com/888697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-4343"
    },
    {
      "cve": "CVE-2014-4344",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-4344"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-4344",
          "url": "https://www.suse.com/security/cve/CVE-2014-4344"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 888697 for CVE-2014-4344",
          "url": "https://bugzilla.suse.com/888697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-4344"
    },
    {
      "cve": "CVE-2014-4345",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-4345"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of \"cpw -keepold\" commands.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-4345",
          "url": "https://www.suse.com/security/cve/CVE-2014-4345"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 770172 for CVE-2014-4345",
          "url": "https://bugzilla.suse.com/770172"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 891082 for CVE-2014-4345",
          "url": "https://bugzilla.suse.com/891082"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-4345"
    },
    {
      "cve": "CVE-2014-5352",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-5352"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-5352",
          "url": "https://www.suse.com/security/cve/CVE-2014-5352"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005509 for CVE-2014-5352",
          "url": "https://bugzilla.suse.com/1005509"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 770172 for CVE-2014-5352",
          "url": "https://bugzilla.suse.com/770172"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912002 for CVE-2014-5352",
          "url": "https://bugzilla.suse.com/912002"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-5352"
    },
    {
      "cve": "CVE-2014-5353",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-5353"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-5353",
          "url": "https://www.suse.com/security/cve/CVE-2014-5353"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 910457 for CVE-2014-5353",
          "url": "https://bugzilla.suse.com/910457"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2014-5353"
    },
    {
      "cve": "CVE-2014-9421",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9421"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9421",
          "url": "https://www.suse.com/security/cve/CVE-2014-9421"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005509 for CVE-2014-9421",
          "url": "https://bugzilla.suse.com/1005509"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 770172 for CVE-2014-9421",
          "url": "https://bugzilla.suse.com/770172"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912002 for CVE-2014-9421",
          "url": "https://bugzilla.suse.com/912002"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-9421"
    },
    {
      "cve": "CVE-2014-9422",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9422"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial \"kadmind\" substring, as demonstrated by a \"ka/x\" principal.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9422",
          "url": "https://www.suse.com/security/cve/CVE-2014-9422"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005509 for CVE-2014-9422",
          "url": "https://bugzilla.suse.com/1005509"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 770172 for CVE-2014-9422",
          "url": "https://bugzilla.suse.com/770172"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912002 for CVE-2014-9422",
          "url": "https://bugzilla.suse.com/912002"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-9422"
    },
    {
      "cve": "CVE-2014-9423",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9423"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
          "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
          "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9423",
          "url": "https://www.suse.com/security/cve/CVE-2014-9423"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005509 for CVE-2014-9423",
          "url": "https://bugzilla.suse.com/1005509"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912002 for CVE-2014-9423",
          "url": "https://bugzilla.suse.com/912002"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-devel-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.i686",
            "SUSE Liberty Linux 7:krb5-libs-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-pkinit-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-server-ldap-0:1.12.2-14.el7.x86_64",
            "SUSE Liberty Linux 7:krb5-workstation-0:1.12.2-14.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-03-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-9423"
    }
  ]
}

CVE-2014-4341 (GCVE-0-2014-4341)

Vulnerability from cvelistv5 – Published: 2014-07-20 10:00 – Updated: 2024-08-06 11:12

Summary

MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

15 references

URL	Tags
https://github.com/krb5/krb5/commit/e6ae703ae597d…	x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://aix.software.ibm.com/aix/efixes/security/n…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/60448	third-party-advisoryx_refsource_SECUNIA
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.securityfocus.com/bid/68909	vdb-entryx_refsource_BID
http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949	x_refsource_CONFIRM
http://www.debian.org/security/2014/dsa-3000	vendor-advisoryx_refsource_DEBIAN
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://security.gentoo.org/glsa/glsa-201412-53.xml	vendor-advisoryx_refsource_GENTOO
http://www.securitytracker.com/id/1030706	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/60082	third-party-advisoryx_refsource_SECUNIA
http://advisories.mageia.org/MGASA-2014-0345.html	x_refsource_CONFIRM
http://secunia.com/advisories/59102	third-party-advisoryx_refsource_SECUNIA

Date Public

2014-06-27 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:12:35.155Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73"
          },
          {
            "name": "mit-kerberos-cve20144341-dos(94904)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94904"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "60448",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60448"
          },
          {
            "name": "FEDORA-2014-8189",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
          },
          {
            "name": "68909",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/68909"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949"
          },
          {
            "name": "DSA-3000",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3000"
          },
          {
            "name": "MDVSA-2014:165",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
          },
          {
            "name": "GLSA-201412-53",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
          },
          {
            "name": "1030706",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030706"
          },
          {
            "name": "60082",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60082"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
          },
          {
            "name": "59102",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59102"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-06-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73"
        },
        {
          "name": "mit-kerberos-cve20144341-dos(94904)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94904"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "name": "60448",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60448"
        },
        {
          "name": "FEDORA-2014-8189",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
        },
        {
          "name": "68909",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/68909"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949"
        },
        {
          "name": "DSA-3000",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3000"
        },
        {
          "name": "MDVSA-2014:165",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
        },
        {
          "name": "GLSA-201412-53",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
        },
        {
          "name": "1030706",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030706"
        },
        {
          "name": "60082",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60082"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
        },
        {
          "name": "59102",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59102"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4341",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73"
            },
            {
              "name": "mit-kerberos-cve20144341-dos(94904)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94904"
            },
            {
              "name": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc",
              "refsource": "CONFIRM",
              "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "60448",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60448"
            },
            {
              "name": "FEDORA-2014-8189",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
            },
            {
              "name": "68909",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/68909"
            },
            {
              "name": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949",
              "refsource": "CONFIRM",
              "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949"
            },
            {
              "name": "DSA-3000",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3000"
            },
            {
              "name": "MDVSA-2014:165",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
            },
            {
              "name": "GLSA-201412-53",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
            },
            {
              "name": "1030706",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030706"
            },
            {
              "name": "60082",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60082"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2014-0345.html",
              "refsource": "CONFIRM",
              "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
            },
            {
              "name": "59102",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59102"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-4341",
    "datePublished": "2014-07-20T10:00:00.000Z",
    "dateReserved": "2014-06-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:12:35.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-4342 (GCVE-0-2014-4342)

Vulnerability from cvelistv5 – Published: 2014-07-20 10:00 – Updated: 2024-08-06 11:12

Summary

MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

12 references

URL	Tags
https://github.com/krb5/krb5/commit/e6ae703ae597d…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/68908	vdb-entryx_refsource_BID
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949	x_refsource_CONFIRM
http://www.debian.org/security/2014/dsa-3000	vendor-advisoryx_refsource_DEBIAN
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.securitytracker.com/id/1030706	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/60082	third-party-advisoryx_refsource_SECUNIA
http://advisories.mageia.org/MGASA-2014-0345.html	x_refsource_CONFIRM
http://secunia.com/advisories/59102	third-party-advisoryx_refsource_SECUNIA

Date Public

2014-06-27 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:12:35.134Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73"
          },
          {
            "name": "68908",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/68908"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949"
          },
          {
            "name": "DSA-3000",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3000"
          },
          {
            "name": "mit-kerberos-cve20144342-dos(94903)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94903"
          },
          {
            "name": "MDVSA-2014:165",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
          },
          {
            "name": "1030706",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030706"
          },
          {
            "name": "60082",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60082"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
          },
          {
            "name": "59102",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59102"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-06-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-19T16:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73"
        },
        {
          "name": "68908",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/68908"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949"
        },
        {
          "name": "DSA-3000",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3000"
        },
        {
          "name": "mit-kerberos-cve20144342-dos(94903)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94903"
        },
        {
          "name": "MDVSA-2014:165",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
        },
        {
          "name": "1030706",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030706"
        },
        {
          "name": "60082",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60082"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
        },
        {
          "name": "59102",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59102"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4342",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73"
            },
            {
              "name": "68908",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/68908"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949",
              "refsource": "CONFIRM",
              "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949"
            },
            {
              "name": "DSA-3000",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3000"
            },
            {
              "name": "mit-kerberos-cve20144342-dos(94903)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94903"
            },
            {
              "name": "MDVSA-2014:165",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
            },
            {
              "name": "1030706",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030706"
            },
            {
              "name": "60082",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60082"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2014-0345.html",
              "refsource": "CONFIRM",
              "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
            },
            {
              "name": "59102",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59102"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-4342",
    "datePublished": "2014-07-20T10:00:00.000Z",
    "dateReserved": "2014-06-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:12:35.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-4343 (GCVE-0-2014-4343)

Vulnerability from cvelistv5 – Published: 2014-08-14 01:00 – Updated: 2024-08-06 11:12

Summary

Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

18 references

URL	Tags
https://github.com/krb5/krb5/commit/f18ddf5d82de0…	x_refsource_CONFIRM
http://aix.software.ibm.com/aix/efixes/security/n…	x_refsource_CONFIRM
http://secunia.com/advisories/61052	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/60448	third-party-advisoryx_refsource_SECUNIA
http://krbdev.mit.edu/rt/Ticket/Display.html?id=7969	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://support.f5.com/kb/en-us/solutions/public/1…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/69159	vdb-entryx_refsource_BID
http://www.debian.org/security/2014/dsa-3000	vendor-advisoryx_refsource_DEBIAN
http://security.gentoo.org/glsa/glsa-201412-53.xml	vendor-advisoryx_refsource_GENTOO
http://www.osvdb.org/109390	vdb-entryx_refsource_OSVDB
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.securitytracker.com/id/1030706	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/60082	third-party-advisoryx_refsource_SECUNIA
http://advisories.mageia.org/MGASA-2014-0345.html	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1121876	x_refsource_CONFIRM
http://secunia.com/advisories/59102	third-party-advisoryx_refsource_SECUNIA

Date Public

2014-07-21 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:12:35.140Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/f18ddf5d82de0ab7591a36e465bc24225776940f"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
          },
          {
            "name": "61052",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61052"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "60448",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60448"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7969"
          },
          {
            "name": "FEDORA-2014-8189",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15553.html"
          },
          {
            "name": "69159",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/69159"
          },
          {
            "name": "DSA-3000",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3000"
          },
          {
            "name": "GLSA-201412-53",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
          },
          {
            "name": "109390",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/109390"
          },
          {
            "name": "kerberos-cve20144343-dos(95211)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95211"
          },
          {
            "name": "1030706",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030706"
          },
          {
            "name": "60082",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60082"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121876"
          },
          {
            "name": "59102",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59102"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-07-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/f18ddf5d82de0ab7591a36e465bc24225776940f"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
        },
        {
          "name": "61052",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61052"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "name": "60448",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60448"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7969"
        },
        {
          "name": "FEDORA-2014-8189",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15553.html"
        },
        {
          "name": "69159",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/69159"
        },
        {
          "name": "DSA-3000",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3000"
        },
        {
          "name": "GLSA-201412-53",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
        },
        {
          "name": "109390",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/109390"
        },
        {
          "name": "kerberos-cve20144343-dos(95211)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95211"
        },
        {
          "name": "1030706",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030706"
        },
        {
          "name": "60082",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60082"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121876"
        },
        {
          "name": "59102",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59102"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4343",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/krb5/krb5/commit/f18ddf5d82de0ab7591a36e465bc24225776940f",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/f18ddf5d82de0ab7591a36e465bc24225776940f"
            },
            {
              "name": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc",
              "refsource": "CONFIRM",
              "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
            },
            {
              "name": "61052",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61052"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "60448",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60448"
            },
            {
              "name": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7969",
              "refsource": "CONFIRM",
              "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7969"
            },
            {
              "name": "FEDORA-2014-8189",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
            },
            {
              "name": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15553.html",
              "refsource": "CONFIRM",
              "url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15553.html"
            },
            {
              "name": "69159",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/69159"
            },
            {
              "name": "DSA-3000",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3000"
            },
            {
              "name": "GLSA-201412-53",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
            },
            {
              "name": "109390",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/109390"
            },
            {
              "name": "kerberos-cve20144343-dos(95211)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95211"
            },
            {
              "name": "1030706",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030706"
            },
            {
              "name": "60082",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60082"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2014-0345.html",
              "refsource": "CONFIRM",
              "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1121876",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121876"
            },
            {
              "name": "59102",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59102"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-4343",
    "datePublished": "2014-08-14T01:00:00.000Z",
    "dateReserved": "2014-06-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:12:35.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-4344 (GCVE-0-2014-4344)

Vulnerability from cvelistv5 – Published: 2014-08-14 01:00 – Updated: 2024-08-06 11:12

Summary

The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

19 references

URL	Tags
https://github.com/krb5/krb5/commit/a7886f0ed1277…	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1121877	x_refsource_CONFIRM
https://github.com/krb5/krb5/commit/524688ce87a15…	x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://aix.software.ibm.com/aix/efixes/security/n…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/60448	third-party-advisoryx_refsource_SECUNIA
http://support.f5.com/kb/en-us/solutions/public/1…	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://secunia.com/advisories/61051	third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2014/dsa-3000	vendor-advisoryx_refsource_DEBIAN
http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970	x_refsource_CONFIRM
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.securityfocus.com/bid/69160	vdb-entryx_refsource_BID
http://www.osvdb.org/109389	vdb-entryx_refsource_OSVDB
http://www.securitytracker.com/id/1030706	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/60082	third-party-advisoryx_refsource_SECUNIA
http://advisories.mageia.org/MGASA-2014-0345.html	x_refsource_CONFIRM
http://secunia.com/advisories/59102	third-party-advisoryx_refsource_SECUNIA

Date Public

2014-07-21 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:12:35.121Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edc"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121877"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b"
          },
          {
            "name": "kerberos-cve20144344-dos(95210)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95210"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "60448",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60448"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15561.html"
          },
          {
            "name": "FEDORA-2014-8189",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
          },
          {
            "name": "61051",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61051"
          },
          {
            "name": "DSA-3000",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3000"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970"
          },
          {
            "name": "MDVSA-2014:165",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
          },
          {
            "name": "69160",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/69160"
          },
          {
            "name": "109389",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/109389"
          },
          {
            "name": "1030706",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030706"
          },
          {
            "name": "60082",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60082"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
          },
          {
            "name": "59102",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59102"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-07-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edc"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121877"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b"
        },
        {
          "name": "kerberos-cve20144344-dos(95210)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95210"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "name": "60448",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60448"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15561.html"
        },
        {
          "name": "FEDORA-2014-8189",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
        },
        {
          "name": "61051",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61051"
        },
        {
          "name": "DSA-3000",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3000"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970"
        },
        {
          "name": "MDVSA-2014:165",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
        },
        {
          "name": "69160",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/69160"
        },
        {
          "name": "109389",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/109389"
        },
        {
          "name": "1030706",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030706"
        },
        {
          "name": "60082",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60082"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
        },
        {
          "name": "59102",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59102"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4344",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edc",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edc"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1121877",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121877"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b"
            },
            {
              "name": "kerberos-cve20144344-dos(95210)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95210"
            },
            {
              "name": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc",
              "refsource": "CONFIRM",
              "url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "60448",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60448"
            },
            {
              "name": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15561.html",
              "refsource": "CONFIRM",
              "url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15561.html"
            },
            {
              "name": "FEDORA-2014-8189",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
            },
            {
              "name": "61051",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61051"
            },
            {
              "name": "DSA-3000",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3000"
            },
            {
              "name": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970",
              "refsource": "CONFIRM",
              "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970"
            },
            {
              "name": "MDVSA-2014:165",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
            },
            {
              "name": "69160",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/69160"
            },
            {
              "name": "109389",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/109389"
            },
            {
              "name": "1030706",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030706"
            },
            {
              "name": "60082",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60082"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2014-0345.html",
              "refsource": "CONFIRM",
              "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
            },
            {
              "name": "59102",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59102"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-4344",
    "datePublished": "2014-08-14T01:00:00.000Z",
    "dateReserved": "2014-06-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:12:35.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-4345 (GCVE-0-2014-4345)

Vulnerability from cvelistv5 – Published: 2014-08-14 01:00 – Updated: 2024-08-06 11:12

Summary

Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of "cpw -keepold" commands.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

30 references

URL	Tags
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://secunia.com/advisories/61353	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
https://github.com/krb5/krb5/commit/dc7ed55c689d5…	x_refsource_CONFIRM
http://secunia.com/advisories/59993	third-party-advisoryx_refsource_SECUNIA
http://krbdev.mit.edu/rt/Ticket/Display.html?id=7980	x_refsource_CONFIRM
http://linux.oracle.com/errata/ELSA-2014-1255.html	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-updates/2014-0…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
https://blogs.oracle.com/sunsecurity/entry/cve_20…	x_refsource_CONFIRM
http://secunia.com/advisories/61314	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securitytracker.com/id/1030705	vdb-entryx_refsource_SECTRACK
https://bugzilla.redhat.com/show_bug.cgi?id=1128157	x_refsource_CONFIRM
http://secunia.com/advisories/60535	third-party-advisoryx_refsource_SECUNIA
http://www.osvdb.org/109908	vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/69168	vdb-entryx_refsource_BID
http://www.debian.org/security/2014/dsa-3000	vendor-advisoryx_refsource_DEBIAN
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://security.gentoo.org/glsa/glsa-201412-53.xml	vendor-advisoryx_refsource_GENTOO
http://kb.juniper.net/InfoCenter/index?page=conte…	x_refsource_CONFIRM
http://secunia.com/advisories/59415	third-party-advisoryx_refsource_SECUNIA
http://web.mit.edu/kerberos/advisories/MITKRB5-SA…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2014-1255.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/60776	third-party-advisoryx_refsource_SECUNIA
https://github.com/krb5/krb5/pull/181	x_refsource_CONFIRM
http://advisories.mageia.org/MGASA-2014-0345.html	x_refsource_CONFIRM
http://secunia.com/advisories/59102	third-party-advisoryx_refsource_SECUNIA

Date Public

2014-08-07 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:12:35.133Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2014-9315",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136640.html"
          },
          {
            "name": "61353",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61353"
          },
          {
            "name": "kerberos-cve20144345-bo(95212)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95212"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/dc7ed55c689d57de7f7408b34631bf06fec9dab1"
          },
          {
            "name": "59993",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59993"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7980"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://linux.oracle.com/errata/ELSA-2014-1255.html"
          },
          {
            "name": "FEDORA-2014-9305",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137056.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
          },
          {
            "name": "openSUSE-SU-2014:1043",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00030.html"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_4345_numeric_errors"
          },
          {
            "name": "61314",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61314"
          },
          {
            "name": "SUSE-SU-2014:1028",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00009.html"
          },
          {
            "name": "1030705",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030705"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1128157"
          },
          {
            "name": "60535",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60535"
          },
          {
            "name": "109908",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/109908"
          },
          {
            "name": "69168",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/69168"
          },
          {
            "name": "DSA-3000",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3000"
          },
          {
            "name": "MDVSA-2014:165",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
          },
          {
            "name": "GLSA-201412-53",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705"
          },
          {
            "name": "59415",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59415"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2014-001.txt"
          },
          {
            "name": "RHSA-2014:1255",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1255.html"
          },
          {
            "name": "60776",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60776"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/pull/181"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
          },
          {
            "name": "59102",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59102"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of \"cpw -keepold\" commands."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-19T16:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2014-9315",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136640.html"
        },
        {
          "name": "61353",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61353"
        },
        {
          "name": "kerberos-cve20144345-bo(95212)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95212"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/dc7ed55c689d57de7f7408b34631bf06fec9dab1"
        },
        {
          "name": "59993",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59993"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7980"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://linux.oracle.com/errata/ELSA-2014-1255.html"
        },
        {
          "name": "FEDORA-2014-9305",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137056.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
        },
        {
          "name": "openSUSE-SU-2014:1043",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00030.html"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_4345_numeric_errors"
        },
        {
          "name": "61314",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61314"
        },
        {
          "name": "SUSE-SU-2014:1028",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00009.html"
        },
        {
          "name": "1030705",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030705"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1128157"
        },
        {
          "name": "60535",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60535"
        },
        {
          "name": "109908",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/109908"
        },
        {
          "name": "69168",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/69168"
        },
        {
          "name": "DSA-3000",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3000"
        },
        {
          "name": "MDVSA-2014:165",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
        },
        {
          "name": "GLSA-201412-53",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705"
        },
        {
          "name": "59415",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59415"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2014-001.txt"
        },
        {
          "name": "RHSA-2014:1255",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1255.html"
        },
        {
          "name": "60776",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60776"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/pull/181"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
        },
        {
          "name": "59102",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59102"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4345",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of \"cpw -keepold\" commands."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2014-9315",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136640.html"
            },
            {
              "name": "61353",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61353"
            },
            {
              "name": "kerberos-cve20144345-bo(95212)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95212"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/dc7ed55c689d57de7f7408b34631bf06fec9dab1",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/dc7ed55c689d57de7f7408b34631bf06fec9dab1"
            },
            {
              "name": "59993",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59993"
            },
            {
              "name": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7980",
              "refsource": "CONFIRM",
              "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7980"
            },
            {
              "name": "http://linux.oracle.com/errata/ELSA-2014-1255.html",
              "refsource": "CONFIRM",
              "url": "http://linux.oracle.com/errata/ELSA-2014-1255.html"
            },
            {
              "name": "FEDORA-2014-9305",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137056.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
            },
            {
              "name": "openSUSE-SU-2014:1043",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00030.html"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_4345_numeric_errors",
              "refsource": "CONFIRM",
              "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_4345_numeric_errors"
            },
            {
              "name": "61314",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61314"
            },
            {
              "name": "SUSE-SU-2014:1028",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00009.html"
            },
            {
              "name": "1030705",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030705"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1128157",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1128157"
            },
            {
              "name": "60535",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60535"
            },
            {
              "name": "109908",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/109908"
            },
            {
              "name": "69168",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/69168"
            },
            {
              "name": "DSA-3000",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3000"
            },
            {
              "name": "MDVSA-2014:165",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
            },
            {
              "name": "GLSA-201412-53",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
            },
            {
              "name": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705",
              "refsource": "CONFIRM",
              "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705"
            },
            {
              "name": "59415",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59415"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2014-001.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2014-001.txt"
            },
            {
              "name": "RHSA-2014:1255",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1255.html"
            },
            {
              "name": "60776",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60776"
            },
            {
              "name": "https://github.com/krb5/krb5/pull/181",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/pull/181"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2014-0345.html",
              "refsource": "CONFIRM",
              "url": "http://advisories.mageia.org/MGASA-2014-0345.html"
            },
            {
              "name": "59102",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59102"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-4345",
    "datePublished": "2014-08-14T01:00:00.000Z",
    "dateReserved": "2014-06-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:12:35.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-5352 (GCVE-0-2014-5352)

Vulnerability from cvelistv5 – Published: 2015-02-19 11:00 – Updated: 2024-08-06 11:41

Summary

The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

14 references

URL	Tags
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://web.mit.edu/kerberos/advisories/MITKRB5-SA…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-0794.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.debian.org/security/2015/dsa-3153	vendor-advisoryx_refsource_DEBIAN
http://lists.opensuse.org/opensuse-updates/2015-0…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.ubuntu.com/usn/USN-2498-1	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/72495	vdb-entryx_refsource_BID
https://github.com/krb5/krb5/commit/82dc33da50338…	x_refsource_CONFIRM
http://web.mit.edu/kerberos/advisories/2015-001-p…	x_refsource_CONFIRM

Date Public

2015-02-03 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:48.869Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2015-2347",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
          },
          {
            "name": "RHSA-2015:0794",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
          },
          {
            "name": "FEDORA-2015-2382",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
          },
          {
            "name": "DSA-3153",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3153"
          },
          {
            "name": "openSUSE-SU-2015:0255",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "SUSE-SU-2015:0290",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
          },
          {
            "name": "MDVSA-2015:069",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
          },
          {
            "name": "USN-2498-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "name": "SUSE-SU-2015:0257",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
          },
          {
            "name": "72495",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/72495"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T15:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2015-2347",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
        },
        {
          "name": "RHSA-2015:0794",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
        },
        {
          "name": "FEDORA-2015-2382",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
        },
        {
          "name": "DSA-3153",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3153"
        },
        {
          "name": "openSUSE-SU-2015:0255",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "name": "SUSE-SU-2015:0290",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
        },
        {
          "name": "MDVSA-2015:069",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
        },
        {
          "name": "USN-2498-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2498-1"
        },
        {
          "name": "SUSE-SU-2015:0257",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
        },
        {
          "name": "72495",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/72495"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-5352",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2015-2347",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
            },
            {
              "name": "RHSA-2015:0794",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
            },
            {
              "name": "FEDORA-2015-2382",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
            },
            {
              "name": "DSA-3153",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2015/dsa-3153"
            },
            {
              "name": "openSUSE-SU-2015:0255",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "SUSE-SU-2015:0290",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
            },
            {
              "name": "MDVSA-2015:069",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
            },
            {
              "name": "USN-2498-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2498-1"
            },
            {
              "name": "SUSE-SU-2015:0257",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
            },
            {
              "name": "72495",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/72495"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-5352",
    "datePublished": "2015-02-19T11:00:00.000Z",
    "dateReserved": "2014-08-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:41:48.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-5353 (GCVE-0-2014-5353)

Vulnerability from cvelistv5 – Published: 2014-12-16 23:00 – Updated: 2024-08-06 11:41

Summary

The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

13 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2015-0794.html	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug…	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://lists.opensuse.org/opensuse-updates/2015-0…	vendor-advisoryx_refsource_SUSE
http://www.securitytracker.com/id/1031376	vdb-entryx_refsource_SECTRACK
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://github.com/krb5/krb5/commit/d1f707024f1d0…	x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-2498-1	vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/71679	vdb-entryx_refsource_BID
http://advisories.mageia.org/MGASA-2014-0536.html	x_refsource_CONFIRM

Date Public

2014-12-05 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:49.048Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2015:0794",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
          },
          {
            "name": "[debian-lts-announce] 20180131 [SECURITY] [DLA 1265-1] krb5 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226"
          },
          {
            "name": "FEDORA-2015-5949",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html"
          },
          {
            "name": "MDVSA-2015:009",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:009"
          },
          {
            "name": "openSUSE-SU-2015:0542",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html"
          },
          {
            "name": "1031376",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031376"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3"
          },
          {
            "name": "USN-2498-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "name": "71679",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/71679"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://advisories.mageia.org/MGASA-2014-0536.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-12-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-02T10:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2015:0794",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
        },
        {
          "name": "[debian-lts-announce] 20180131 [SECURITY] [DLA 1265-1] krb5 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226"
        },
        {
          "name": "FEDORA-2015-5949",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html"
        },
        {
          "name": "MDVSA-2015:009",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:009"
        },
        {
          "name": "openSUSE-SU-2015:0542",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html"
        },
        {
          "name": "1031376",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031376"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3"
        },
        {
          "name": "USN-2498-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2498-1"
        },
        {
          "name": "71679",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/71679"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://advisories.mageia.org/MGASA-2014-0536.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-5353",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2015:0794",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
            },
            {
              "name": "[debian-lts-announce] 20180131 [SECURITY] [DLA 1265-1] krb5 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"
            },
            {
              "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226",
              "refsource": "CONFIRM",
              "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226"
            },
            {
              "name": "FEDORA-2015-5949",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html"
            },
            {
              "name": "MDVSA-2015:009",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:009"
            },
            {
              "name": "openSUSE-SU-2015:0542",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html"
            },
            {
              "name": "1031376",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031376"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3"
            },
            {
              "name": "USN-2498-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2498-1"
            },
            {
              "name": "71679",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/71679"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2014-0536.html",
              "refsource": "CONFIRM",
              "url": "http://advisories.mageia.org/MGASA-2014-0536.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-5353",
    "datePublished": "2014-12-16T23:00:00.000Z",
    "dateReserved": "2014-08-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:41:49.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9421 (GCVE-0-2014-9421)

Vulnerability from cvelistv5 – Published: 2015-02-19 11:00 – Updated: 2024-08-06 13:47

Summary

The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

14 references

URL	Tags
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://web.mit.edu/kerberos/advisories/MITKRB5-SA…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-0794.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.debian.org/security/2015/dsa-3153	vendor-advisoryx_refsource_DEBIAN
http://lists.opensuse.org/opensuse-updates/2015-0…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.ubuntu.com/usn/USN-2498-1	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/72496	vdb-entryx_refsource_BID
https://github.com/krb5/krb5/commit/a197e92349a4a…	x_refsource_CONFIRM
http://web.mit.edu/kerberos/advisories/2015-001-p…	x_refsource_CONFIRM

Date Public

2015-02-03 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:47:41.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2015-2347",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
          },
          {
            "name": "RHSA-2015:0794",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
          },
          {
            "name": "FEDORA-2015-2382",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
          },
          {
            "name": "DSA-3153",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3153"
          },
          {
            "name": "openSUSE-SU-2015:0255",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "SUSE-SU-2015:0290",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
          },
          {
            "name": "MDVSA-2015:069",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
          },
          {
            "name": "USN-2498-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "name": "SUSE-SU-2015:0257",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
          },
          {
            "name": "72496",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/72496"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/a197e92349a4aa2141b5dff12e9dd44c2a2166e3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T15:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2015-2347",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
        },
        {
          "name": "RHSA-2015:0794",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
        },
        {
          "name": "FEDORA-2015-2382",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
        },
        {
          "name": "DSA-3153",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3153"
        },
        {
          "name": "openSUSE-SU-2015:0255",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "name": "SUSE-SU-2015:0290",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
        },
        {
          "name": "MDVSA-2015:069",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
        },
        {
          "name": "USN-2498-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2498-1"
        },
        {
          "name": "SUSE-SU-2015:0257",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
        },
        {
          "name": "72496",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/72496"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/a197e92349a4aa2141b5dff12e9dd44c2a2166e3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9421",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2015-2347",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
            },
            {
              "name": "RHSA-2015:0794",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
            },
            {
              "name": "FEDORA-2015-2382",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
            },
            {
              "name": "DSA-3153",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2015/dsa-3153"
            },
            {
              "name": "openSUSE-SU-2015:0255",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "SUSE-SU-2015:0290",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
            },
            {
              "name": "MDVSA-2015:069",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
            },
            {
              "name": "USN-2498-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2498-1"
            },
            {
              "name": "SUSE-SU-2015:0257",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
            },
            {
              "name": "72496",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/72496"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/a197e92349a4aa2141b5dff12e9dd44c2a2166e3",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/a197e92349a4aa2141b5dff12e9dd44c2a2166e3"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9421",
    "datePublished": "2015-02-19T11:00:00.000Z",
    "dateReserved": "2014-12-26T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:47:41.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9422 (GCVE-0-2014-9422)

Vulnerability from cvelistv5 – Published: 2015-02-19 11:00 – Updated: 2024-08-06 13:47

Summary

The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

14 references

URL	Tags
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://web.mit.edu/kerberos/advisories/MITKRB5-SA…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-0794.html	vendor-advisoryx_refsource_REDHAT
https://github.com/krb5/krb5/commit/6609658db0799…	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.debian.org/security/2015/dsa-3153	vendor-advisoryx_refsource_DEBIAN
http://lists.opensuse.org/opensuse-updates/2015-0…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/72494	vdb-entryx_refsource_BID
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.ubuntu.com/usn/USN-2498-1	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://web.mit.edu/kerberos/advisories/2015-001-p…	x_refsource_CONFIRM

Date Public

2015-02-03 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:47:40.890Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2015-2347",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
          },
          {
            "name": "RHSA-2015:0794",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/6609658db0799053fbef0d7d0aa2f1fd68ef32d8"
          },
          {
            "name": "FEDORA-2015-2382",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
          },
          {
            "name": "DSA-3153",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3153"
          },
          {
            "name": "openSUSE-SU-2015:0255",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "SUSE-SU-2015:0290",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
          },
          {
            "name": "72494",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/72494"
          },
          {
            "name": "MDVSA-2015:069",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
          },
          {
            "name": "USN-2498-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "name": "SUSE-SU-2015:0257",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial \"kadmind\" substring, as demonstrated by a \"ka/x\" principal."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T15:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2015-2347",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
        },
        {
          "name": "RHSA-2015:0794",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/6609658db0799053fbef0d7d0aa2f1fd68ef32d8"
        },
        {
          "name": "FEDORA-2015-2382",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
        },
        {
          "name": "DSA-3153",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3153"
        },
        {
          "name": "openSUSE-SU-2015:0255",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "name": "SUSE-SU-2015:0290",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
        },
        {
          "name": "72494",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/72494"
        },
        {
          "name": "MDVSA-2015:069",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
        },
        {
          "name": "USN-2498-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2498-1"
        },
        {
          "name": "SUSE-SU-2015:0257",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9422",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial \"kadmind\" substring, as demonstrated by a \"ka/x\" principal."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2015-2347",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
            },
            {
              "name": "RHSA-2015:0794",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/6609658db0799053fbef0d7d0aa2f1fd68ef32d8",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/6609658db0799053fbef0d7d0aa2f1fd68ef32d8"
            },
            {
              "name": "FEDORA-2015-2382",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
            },
            {
              "name": "DSA-3153",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2015/dsa-3153"
            },
            {
              "name": "openSUSE-SU-2015:0255",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "SUSE-SU-2015:0290",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
            },
            {
              "name": "72494",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/72494"
            },
            {
              "name": "MDVSA-2015:069",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
            },
            {
              "name": "USN-2498-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2498-1"
            },
            {
              "name": "SUSE-SU-2015:0257",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9422",
    "datePublished": "2015-02-19T11:00:00.000Z",
    "dateReserved": "2014-12-26T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:47:40.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9423 (GCVE-0-2014-9423)

Vulnerability from cvelistv5 – Published: 2015-02-19 11:00 – Updated: 2024-08-06 13:47

Summary

The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

13 references

URL	Tags
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://web.mit.edu/kerberos/advisories/MITKRB5-SA…	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.debian.org/security/2015/dsa-3153	vendor-advisoryx_refsource_DEBIAN
http://lists.opensuse.org/opensuse-updates/2015-0…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8…	x_refsource_CONFIRM
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.ubuntu.com/usn/USN-2498-1	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/72503	vdb-entryx_refsource_BID
http://web.mit.edu/kerberos/advisories/2015-001-p…	x_refsource_CONFIRM

Date Public

2015-02-03 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:47:41.334Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2015-2347",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
          },
          {
            "name": "FEDORA-2015-2382",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
          },
          {
            "name": "DSA-3153",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3153"
          },
          {
            "name": "openSUSE-SU-2015:0255",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "SUSE-SU-2015:0290",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8dd22bc9526751610aaa255ead9c"
          },
          {
            "name": "MDVSA-2015:069",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
          },
          {
            "name": "USN-2498-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "name": "SUSE-SU-2015:0257",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
          },
          {
            "name": "72503",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/72503"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2015-2347",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
        },
        {
          "name": "FEDORA-2015-2382",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
        },
        {
          "name": "DSA-3153",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3153"
        },
        {
          "name": "openSUSE-SU-2015:0255",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "name": "SUSE-SU-2015:0290",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8dd22bc9526751610aaa255ead9c"
        },
        {
          "name": "MDVSA-2015:069",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
        },
        {
          "name": "USN-2498-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2498-1"
        },
        {
          "name": "SUSE-SU-2015:0257",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
        },
        {
          "name": "72503",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/72503"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9423",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2015-2347",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
            },
            {
              "name": "FEDORA-2015-2382",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
            },
            {
              "name": "DSA-3153",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2015/dsa-3153"
            },
            {
              "name": "openSUSE-SU-2015:0255",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "SUSE-SU-2015:0290",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8dd22bc9526751610aaa255ead9c",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8dd22bc9526751610aaa255ead9c"
            },
            {
              "name": "MDVSA-2015:069",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
            },
            {
              "name": "USN-2498-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2498-1"
            },
            {
              "name": "SUSE-SU-2015:0257",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
            },
            {
              "name": "72503",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/72503"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9423",
    "datePublished": "2015-02-19T11:00:00.000Z",
    "dateReserved": "2014-12-26T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:47:41.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.