Security Update for krb5 Package
Summary
DSA-3000-1: krb5 - security update. Affects krb5 versions < 1.10.1+dfsg-5+deb7u2. Fixed in 1.10.1+dfsg-5+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The krb5 package is the MIT implementation of Kerberos, a network authentication protocol. It provides secure authentication for client/server applications by using secret-key cryptography. The package is widely used in various systems and applications to ensure secure communication and access control. However, several vulnerabilities have been discovered in krb5, which could potentially allow remote attackers to crash programs, execute arbitrary code, or cause buffer overflows.
Vulnerability Detail
The vulnerabilities identified in krb5 include:
-
CVE-2014-4341: An unauthenticated remote attacker can cause a program crash by injecting packets into a GSSAPI application session, leading to invalid memory references.
-
CVE-2014-4342: An unauthenticated remote attacker can cause a program crash by injecting packets into a GSSAPI application session, resulting in invalid memory references or null pointer dereferences.
-
CVE-2014-4343: An unauthenticated remote attacker can cause a double-free condition in GSSAPI initiators using the SPNEGO mechanism, potentially leading to application crashes or arbitrary code execution.
-
CVE-2014-4344: An unauthenticated or partially authenticated remote attacker can cause a NULL dereference and application crash during SPNEGO negotiation.
-
CVE-2014-4345: When kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause a buffer overflow, leading to an out-of-bounds write.
These vulnerabilities pose a significant risk to the security and stability of systems using the krb5 package.
How To Fix
Minimum fixed version
1.10.1+dfsg-5+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade krb5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is essential to apply the recommended package upgrades to ensure the security of the system.
Conclusion
The krb5 package has been found to have several vulnerabilities that can be exploited by remote attackers. To ensure the security and stability of systems, it is crucial to upgrade to the fixed versions of the package. Applying the recommended upgrades will address the identified vulnerabilities and mitigate the associated risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for krb5 →
FAQ
krb5 is the MIT implementation of Kerberos, a network authentication protocol.
These vulnerabilities can lead to program crashes, arbitrary code execution, and buffer overflows, potentially compromising the security and stability of systems.
To fix these vulnerabilities, upgrade the krb5 package to the recommended versions: 1.10.1+dfsg-5+deb7u2 for the stable distribution (wheezy) and 1.12.1+dfsg-7 for the unstable distribution (sid).
No specific workarounds are mentioned. It is crucial to apply the recommended package upgrades to mitigate the vulnerabilities.
You can find more information about these vulnerabilities in the Common Vulnerabilities and Exposures (CVE) database. The CVE identifiers for these vulnerabilities are CVE-2014-4341, CVE-2014-4342, CVE-2014-4343, CVE-2014-4344, and CVE-2014-4345.
Related vulnerabilities
Recent vulnerabilities recorded for krb5.
