FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092

Affected packages
krb5 < 1.13_1
krb5-112 < 1.12.2_1
krb5-111 < 1.11.5_4

Details

VuXML ID 24ce5597-acab-11e4-a847-206a8a720317
Discovery 2015-02-03
Entry 2015-02-04

SO-AND-SO reports:

CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind are vulnerable as they can be instructed to call gss_process_context_token().

CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may perform use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications may also be vulnerable if they contain insufficiently defensive XDR functions.

CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm.

CVE-2014-9423: libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients.

References

CVE Name CVE-2014-5352
CVE Name CVE-2014-9421
CVE Name CVE-2014-9422
CVE Name CVE-2014-9423
URL http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt