PT-2015-3796 · Mit+6 · Mit Kerberos 5+6

Tim Uglow · Published 2015-02-20 · Updated 2024-06-15 · CVE-2014-5355

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (aka krb5) versions prior to 1.13.2

Description The issue allows remote attackers to cause a denial of service, either through a NULL pointer dereference by using a zero-byte version string, or through an out-of-bounds read by omitting the '0' character. This is related to errors in handling krb5 read message data fields.

Recommendations For versions prior to 1.13.2, update to version 1.13.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the krb5 read message function to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2015-1898

CESA-2015_0794

CESA-2015_2154

CVE-2014-5355

DLA-1265-1

MGASA-2015-0119

OPENSUSE-SU-2024:10004-1

RHSA-2015:0794

RHSA-2015:2154

RHSA-2015_0794

RHSA-2015_2154

SUSE-SU-2015:1276-1

SUSE-SU-2015:1282-1

USN-2810-1

Affected Products

Alt Linux

Centos

Ibm Aix

Mit Kerberos 5

Red Hat

Suse

Ubuntu

References · 93

• https://ubuntu.com/security/CVE-2015-2695 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2002-2443 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-2697 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5355 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2154.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5355 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2810-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1276-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10004-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5355 · Vendor Advisory
• http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-5355 · Security Note
• https://advisories.mageia.org/MGASA-2015-0119.html · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0794.html · Vendor Advisory