PT-2004-1058 · Mit+1 · Krb5-Devel+5

Published 2004-09-10 · Updated 2024-02-02 · CVE-2004-0642

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions krb5-devel versions 1.2.2 krb5-server versions 1.2.2 krb5-libs versions 1.2.2 krb5-workstation versions 1.2.2 MIT Kerberos 5 (krb5) versions prior to 1.3.4

Description The issue concerns multiple vulnerabilities in the krb5 package of Red Hat Enterprise Linux and MIT Kerberos 5 (krb5), which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, double free vulnerabilities exist in the error handling code for ASN.1 decoders in the Key Distribution Center (KDC) library and the client library for MIT Kerberos 5 (krb5) 1.3.4 and earlier, potentially allowing remote attackers to execute arbitrary code.

Recommendations For krb5-devel version 1.2.2, update to a version later than 1.2.2. For krb5-server version 1.2.2, update to a version later than 1.2.2. For krb5-libs version 1.2.2, update to a version later than 1.2.2. For krb5-workstation version 1.2.2, update to a version later than 1.2.2. For MIT Kerberos 5 (krb5) versions prior to 1.3.4, update to version 1.3.4 or later. As a temporary workaround, consider restricting access to the Key Distribution Center (KDC) library and the client library until a patch is available.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2015-06282

BDU:2015-06285

BDU:2015-06289

BDU:2015-06293

CVE-2004-0642

DSA-543-1

RHSA-2004:350

Affected Products

Mit Kerberos 5

Red Hat

Krb5-Devel

Krb5-Libs

Krb5-Server

Krb5-Workstation

References · 23

• http://debian.org/security/2004/dsa-543 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0642 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0642 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06285 · Security Note
• http://rhn.redhat.com/errata/RHSA-2004-350.html · Vendor Advisory
• http://trustix.net/errata/2004/0045 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0642 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000860 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200409-09.xml · Vendor Advisory
• http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-002-dblfree.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06293 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2004-0642 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06282 · Security Note
• https://bdu.fstec.ru/vul/2015-06289 · Security Note
• http://securityfocus.com/bid/11078 · Note