Lucene search

K
mageiaGentoo FoundationMGASA-2014-0345
HistoryAug 22, 2014 - 2:58 p.m.

Updated krb5 package fixes security vulnerabilities

2014-08-2214:58:14
Gentoo Foundation
advisories.mageia.org
19

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS

0.196

Percentile

96.3%

MIT Kerberos 5 allows attackers to cause a denial of service via a buffer over-read or NULL pointer dereference, by injecting invalid tokens into a GSSAPI application session (CVE-2014-4341, CVE-2014-4342). MIT Kerberos 5 allows attackers to cause a denial of service via a double-free flaw or NULL pointer dereference, while processing invalid SPNEGO tokens (CVE-2014-4343, CVE-2014-4344). In MIT Kerberos 5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause it to perform an out-of-bounds write (buffer overflow) (CVE-2014-4345).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchkrb5< 1.11.1-1.4krb5-1.11.1-1.4.mga3
Mageia4noarchkrb5< 1.11.4-1.1krb5-1.11.4-1.1.mga4

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS

0.196

Percentile

96.3%