USN-1520-1 : krb5 vulnerabilities

NASLDB: USN-1520-1 : krb5 vulnerabilities

General

ID: 61379
Name: USN-1520-1 : krb5 vulnerabilities

Summary: Checks dpkg output for updated package(s)

Credits: –

Classification

Risk: –

CVSS: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Base Vector: –
CVSS Temporal Vector: –

Port: 0
Family: Ubuntu Local Security Checks
Type: Local

Description

Emmanuel Bouillon discovered that the MIT krb5 Key Distribution
Center (KDC) daemon could free an uninitialized pointer when handling
a malformed AS-REQ message. A remote unauthenticated attacker could
use this to cause a denial of service or possibly execute arbitrary
code. (CVE-2012-1015)

Emmanuel Bouillon discovered that the MIT krb5 Key Distribution
Center (KDC) daemon could dereference an uninitialized pointer while
handling a malformed AS-REQ message. A remote unauthenticated
attacker could use this to cause a denial of service or possibly
execute arbitrary code. This issue only affected Ubuntu 12.04 LTS.
(CVE-2012-1014)

Simo Sorce discovered that the MIT krb5 Key Distribution Center (KDC)
daemon could dereference a NULL pointer when handling a malformed
TGS-REQ message. A remote authenticated attacker could use this to
cause a denial of service. (CVE-2012-1013)

It was discovered that the kadmin protocol implementation in MIT krb5
did not properly restrict access to the SET_STRING and GET_STRINGS
operations. A remote authenticated attacker could use this to expose
or modify sensitive information. This issue only affected Ubuntu
12.04 LTS. (CVE-2012-1012)