PT-2014-6431 · Mit+3 · Mit Kerberos 5+3

Publicado 2014-12-05 · Atualizado 2024-06-15 · CVE-2014-5354

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (aka krb5) versions 1.12.x through 1.13.0

Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon crash due to a NULL pointer dereference. This can be achieved by creating a database entry for a keyless principal. The estimated number of potentially affected devices worldwide is not specified. Real-world incidents where this issue was exploited are not mentioned.

Recommendations For MIT Kerberos 5 (aka krb5) versions 1.12.x through 1.13.0, update to version 1.13.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the add principal and purgekeys commands in kadmin to minimize the risk of exploitation. Avoid creating database entries for keyless principals until the issue is resolved.

Correção

Identificadores relacionados

ALT-PU-2014-2418

ALT-PU-2014-2482

CVE-2014-5354

OPENSUSE-SU-2024:10004-1

SUSE-SU-2015:1276-1

SUSE-SU-2015:1282-1

USN-2498-1

Produtos afetados

Alt Linux

Mit Kerberos 5

Suse

Ubuntu

Referências · 83

• https://github.com/krb5/krb5/commit/04038bf3633c4b909b5ded3072dc88c8c419bf16 · Nota
• https://suse.com/security/cve/CVE-2010-1324 · Nota
• https://suse.com/security/cve/CVE-2015-2697 · Nota
• https://ubuntu.com/security/CVE-2014-9422 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-3119 · Nota
• https://suse.com/support/update/announcement/2015/suse-su-20151276-1 · Nota
• https://suse.com/security/cve/CVE-2014-9421 · Nota
• https://suse.com/security/cve/CVE-2011-0285 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5354 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-4345 · Nota
• https://suse.com/security/cve/CVE-2015-8631 · Nota
• https://suse.com/security/cve/CVE-2009-0844 · Nota
• https://suse.com/security/cve/CVE-2014-5355 · Nota
• https://osv.dev/vulnerability/CVE-2014-5354 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2009-0847 · Nota