PT-2015-3796 · Mit+6 · Mit Kerberos 5+6

Tim Uglow

·

Publicado

2015-02-20

·

Atualizado

2024-06-15

·

CVE-2014-5355

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (aka krb5) versions prior to 1.13.2
Description The issue allows remote attackers to cause a denial of service, either through a NULL pointer dereference by using a zero-byte version string, or through an out-of-bounds read by omitting the '0' character. This is related to errors in handling krb5 read message data fields.
Recommendations For versions prior to 1.13.2, update to version 1.13.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the krb5 read message function to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

ALT-PU-2015-1898
CESA-2015_0794
CESA-2015_2154
CVE-2014-5355
DLA-1265-1
MGASA-2015-0119
OPENSUSE-SU-2024:10004-1
RHSA-2015:0794
RHSA-2015:2154
RHSA-2015_0794
RHSA-2015_2154
SUSE-SU-2015:1276-1
SUSE-SU-2015:1282-1
USN-2810-1

Produtos afetados

Alt Linux
Centos
Ibm Aix
Mit Kerberos 5
Red Hat
Suse
Ubuntu