CVE-2014-5355

MIT Kerberos 5 through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a zero-byte version string or cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c (CVE-2014-5355).

These are all security issues fixed in the krb5-1.15-1.1 package on the GA media of openSUSE Tumbleweed.

krb5 was updated to fix four security issues.

These security issues were fixed:

• CVE-2014-5353: NULL pointer dereference when using a ticket policy name as password name (bsc#910457).
• CVE-2014-5354: NULL pointer dereference when using keyless entries (bsc#910458).
• CVE-2014-5355: Denial of service in krb5_read_message (bsc#918595).
• CVE-2015-2694: OTP and PKINIT kdcpreauth modules leading to requires_preauth bypass (bsc#928978).

krb5 was updated to fix three security issues.

Remote authenticated users could cause denial of service.

These security issues were fixed:

• CVE-2014-5353: NULL pointer dereference when using a ticket policy name as password name (bsc#910457).
• CVE-2014-5354: NULL pointer dereference when using keyless entries (bsc#910458).
• CVE-2014-5355: Denial of service in krb5_read_message (bsc#918595).

MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.

It was discovered that the Kerberos kpasswd service incorrectly handled certain UDP packets. A remote attacker could possibly use this issue to cause resource consumption, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2002-2443)

It was discovered that Kerberos incorrectly handled null bytes in certain data fields. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-5355)

It was discovered that the Kerberos kdcpreauth modules incorrectly tracked certain client requests. A remote attacker could possibly use this issue to bypass intended preauthentication requirements. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2694)

It was discovered that Kerberos incorrectly handled certain SPNEGO packets. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2695)

It was discovered that Kerberos incorrectly handled certain IAKERB packets. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2696, CVE-2015-2698)

It was discovered that Kerberos incorrectly handled certain TGS requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2697)