krb5 - Security Update
Summary
DSA-3466-1: krb5 - security update. Affects krb5 versions < 1.10.1+dfsg-5+deb7u7. Fixed in 1.10.1+dfsg-5+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
krb5 is the MIT implementation of Kerberos, a network authentication protocol. It provides secure authentication for client/server applications by using secret-key cryptography. The krb5 package is used in Debian 7 (wheezy) and Debian 8 (jessie) distributions.
Vulnerability Detail
Several vulnerabilities have been discovered in krb5. The first vulnerability, identified as CVE-2015-8629, allows an authenticated attacker to read beyond the allocated memory by sending a string without a terminating zero byte. This can lead to information leakage for attackers with permission to modify the database. The second vulnerability, CVE-2015-8630, enables an authenticated attacker to dereference a null pointer by supplying a null policy value while including KADM5_POLICY in the mask. The third vulnerability, CVE-2015-8631, allows an authenticated attacker to leak memory by supplying a null principal name in a request that uses one. Repeating these requests can exhaust all available memory.
How To Fix
Minimum fixed version
1.10.1+dfsg-5+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade krb5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the krb5 packages to the recommended versions will address the identified vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for krb5 →
FAQ
krb5 is the MIT implementation of Kerberos, a network authentication protocol.
The vulnerabilities in krb5 are CVE-2015-8629, CVE-2015-8630, and CVE-2015-8631.
CVE-2015-8629 allows an authenticated attacker to read beyond the allocated memory, potentially leading to information leakage.
To fix the vulnerabilities, upgrade the krb5 packages to the recommended versions.
There is no mentioned workaround for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for krb5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
