PT-2015-5841 · Mit+3 · Mit Kerberos 5+3

Greg Hudson · Published 2015-11-06 · Updated 2024-06-15 · CVE-2015-2698

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (aka krb5) version 1.14 pre-release 2015-09-14

Description The issue is related to the iakerb gss export sec context function in lib/gssapi/krb5/iakerb.c, which improperly accesses a certain pointer. This allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss export sec context function.

Recommendations For MIT Kerberos 5 (aka krb5) version 1.14 pre-release 2015-09-14, consider updating to a newer version that correctly fixes the issue, as the current version contains an incorrect fix that introduces this problem. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-1392

CVE-2015-2698

MGASA-2015-0446

OPENSUSE-SU-2024:10004-1

SUSE-SU-2015:2302-1

SUSE-SU-2015_2302-1

USN-2810-1

Affected Products

Alt Linux

Mit Kerberos 5

Suse

Ubuntu

References · 83

• https://ubuntu.com/security/CVE-2015-2695 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:2302-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2002-2443 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-2697 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5355 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-2698 · Security Note
• https://osv.dev/vulnerability/USN-2810-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0446.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10004-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2698 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-2696 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2015-November/171079.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0446 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2810-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-2694 · Vendor Advisory