PT-2014-1771 · Mit+6 · Mit Kerberos 5+7

Published 2014-07-20 · Updated 2024-06-15 · CVE-2014-4341

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions prior to 1.12.2 mit-krb5 versions prior to 1.13

Description The issue allows remote attackers to cause a denial of service by injecting invalid tokens into a GSSAPI application session, potentially leading to a buffer over-read and application crash. Exploitation of the vulnerabilities may compromise the confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited by a remote attacker who has passed the authentication procedure.

Recommendations For MIT Kerberos 5 versions prior to 1.12.2, update to version 1.12.2 or later to resolve the issue. For mit-krb5 versions prior to 1.13, update to version 1.13 or later to resolve the issue. As a temporary workaround, consider restricting access to GSSAPI application sessions to minimize the risk of exploitation.

Fix

DoS

Out of bounds Read

Double Free

Weakness Enumeration

CWE-125

CWE-415

Related Identifiers

ALT-PU-2014-2418

BDU:2015-01984

BDU:2015-09790

CESA-2014_1389

CESA-2015_0439

CVE-2014-4341

DLA-37-1

DSA-3000-1

MGASA-2014-0345

OPENSUSE-SU-2024:10004-1

RHSA-2014:1245

RHSA-2014:1389

RHSA-2014_1245

RHSA-2014_1389

RHSA-2015:0439

RHSA-2015_0439

SUSE-SU-2014_0989-1

USN-2310-1

Affected Products

Alt Linux

Centos

Ibm Aix

Mit Kerberos 5

Red Hat

Suse

Ubuntu

Mit-Krb5

References · 103

• https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73 · Patch
• https://ubuntu.com/security/CVE-2013-6800 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4344 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0439.html · Vendor Advisory
• http://debian.org/security/2014/dsa-3000 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4344 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10004-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4341 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-0439.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4342 · Security Note
• https://ubuntu.com/security/notices/USN-2310-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201412-53.xml · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-4341 · Security Note
• https://osv.dev/vulnerability/USN-2310-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4343 · Vendor Advisory