PT-2014-1772 · Mit+6 · Krb5+7

Published 2014-07-20 · Updated 2024-06-15 · CVE-2014-4343

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (aka krb5) versions 1.10.x through 1.12.x before 1.12.2 mit-krb5 versions prior to 1.13

Description The issue is related to a double free vulnerability in the init ctx reselect function in the SPNEGO initiator. This vulnerability can be exploited by an unauthenticated remote attacker who can spoof packets appearing to be from a GSSAPI acceptor, causing a double-free condition in GSSAPI initiators (clients) using the SPNEGO mechanism. The attacker can achieve this by returning a different underlying mechanism than was proposed by the initiator. This can lead to a denial of service (memory corruption) or possibly execute arbitrary code via network traffic.

Recommendations For MIT Kerberos 5 (aka krb5) versions 1.10.x through 1.12.x before 1.12.2, update to version 1.12.2 or later to resolve the issue. For mit-krb5 versions prior to 1.13, update to version 1.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the SPNEGO mechanism in GSSAPI initiators (clients) until a patch is available.

Fix

DoS

Out of bounds Read

Double Free

Weakness Enumeration

CWE-125

CWE-415

Related Identifiers

ALT-PU-2014-2418

BDU:2015-01984

BDU:2015-09790

CESA-2014_1389

CESA-2015_0439

CVE-2014-4343

DLA-37-1

DSA-3000-1

MGASA-2014-0345

OPENSUSE-SU-2024:10004-1

RHSA-2014:1389

RHSA-2014_1389

RHSA-2015:0439

RHSA-2015_0439

USN-2310-1

Affected Products

Alt Linux

Centos

Ibm Aix

Mit Kerberos 5

Red Hat

Suse

Ubuntu

Krb5

References · 106

• https://github.com/krb5/krb5/commit/f18ddf5d82de0ab7591a36e465bc24225776940f · Patch
• https://ubuntu.com/security/CVE-2013-6800 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4344 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0439.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-4343 · Vendor Advisory
• http://debian.org/security/2014/dsa-3000 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4344 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10004-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-0439.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4342 · Security Note
• https://ubuntu.com/security/notices/USN-2310-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201412-53.xml · Vendor Advisory
• https://osv.dev/vulnerability/USN-2310-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4341 · Vendor Advisory