Security Update for krb5
Summary
DSA-3153-1: krb5 - security update. Affects krb5 versions < 1.10.1+dfsg-5+deb7u3. Fixed in 1.10.1+dfsg-5+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
krb5 is the MIT implementation of Kerberos, a network authentication protocol. It provides secure authentication for client/server applications by using secret-key cryptography. The package is widely used in various systems and applications to ensure secure communication and access control.
Vulnerability Detail
Multiple vulnerabilities have been discovered in krb5. These include:
- CVE-2014-5352: Incorrect memory management in the libgssapi_krb5 library may lead to denial of service or the execution of arbitrary code.
- CVE-2014-9421: Incorrect memory management in kadmind's processing of XDR data may result in denial of service or the execution of arbitrary code.
- CVE-2014-9422: Incorrect processing of two-component server principals may lead to impersonation attacks.
- CVE-2014-9423: An information leak in the libgssrpc library.
These vulnerabilities pose a significant risk to the security and integrity of systems utilizing krb5. Attackers may exploit these vulnerabilities to gain unauthorized access, execute arbitrary code, or cause denial of service.
How To Fix
Minimum fixed version
1.10.1+dfsg-5+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade krb5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been provided for these vulnerabilities. It is crucial to apply the recommended package upgrades to ensure the security of the system.
Conclusion
Upgrading the krb5 packages to the fixed versions is crucial to mitigate the risks associated with these vulnerabilities. Failure to do so may result in unauthorized access, code execution, or denial of service. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for krb5 →
FAQ
krb5 is the MIT implementation of Kerberos, a network authentication protocol.
These vulnerabilities may allow attackers to gain unauthorized access, execute arbitrary code, or cause denial of service.
To fix these vulnerabilities, upgrade the krb5 packages to the recommended versions.
No specific workarounds have been provided. It is essential to apply the package upgrades.
For more information, refer to the CVE identifiers mentioned in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for krb5.
