Multiple vulnerabilities have been discovered in MIT krb5, the worst of which could lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.21.2 | >= 1.21.2 |
MIT krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology.
Multiple vulnerabilities have been discovered in MIT krb5. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All MIT krb5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.21.2"
A vulnerability in MIT Kerberos 5 could lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.18.2-r2 | >= 1.18.2-r2 |
The MIT Kerberos 5 implementation provides a command line telnet client which is used for remote login via the telnet protocol.
It was discovered that MIT Kerberos network authentication system, krb5, did not properly handle ASN.1-encoded Kerberos messages.
A remote attacker could send a specially crafted Kerberos message, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.18.2-r2"
Multiple vulnerabilities have been discovered in MIT Kerberos 5, the worst of which may allow remote attackers to cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.13.2-r2 | >= 1.13.2-r2 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol.
Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.13.2-r2"
A vulnerability has been found in MIT Kerberos 5, possibly resulting in arbitrary code execution or a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.13 | >= 1.13 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol.
Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please review the CVE identifiers referenced below for details.
A remote attacker could execute arbitrary code with the privileges of the process or cause Denial of Service.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.13"
Multiple vulnerabilities have been discovered in MIT Kerberos 5, allowing execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.11.4 | >= 1.11.4 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol.
Multiple vulnerabilities have been discovered in the Key Distribution Center in MIT Kerberos 5. Please review the CVE identifiers referenced below for details.
A remote attacker could send a specially crafted request, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Additionally, a remote attacker could impersonate a kadmind server and send a specially crafted packet to the password change port, which can result in a ping-pong condition and a Denial of Service condition.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.11.4"
Multiple vulnerabilities have been found in MIT Kerberos 5, the most severe of which may allow remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.9.2-r1 | >= 1.9.2-r1 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol.
Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to execute arbitrary code with the privileges of the administration daemon or the Key Distribution Center (KDC) daemon, cause a Denial of Service condition, or possibly obtain sensitive information. Furthermore, a remote attacker may be able to spoof Kerberos authorization, modify KDC responses, forge user data messages, forge tokens, forge signatures, impersonate a client, modify user-visible prompt text, or have other unspecified impact.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.9.2-r1"
Multiple vulnerabilities in MIT Kerberos 5 might allow remote unauthenticated users to execute arbitrary code with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.6.3-r6 | >= 1.6.3-r6 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. kadmind is the MIT Kerberos 5 administration daemon, KDC is the Key Distribution Center.
Multiple vulnerabilities have been reported in MIT Kerberos 5:
A remote unauthenticated attacker could exploit the first vulnerability to cause a Denial of Service or, in unlikely circumstances, execute arbitrary code on the host running krb5kdc or kadmind with root privileges and compromise the Kerberos key database. Exploitation of the other vulnerabilities might lead to a Denial of Service in kadmind, krb5kdc, or other daemons performing authorization against Kerberos that utilize GSS-API or an information disclosure.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.6.3-r6"
Multiple vulnerabilities have been found in MIT Kerberos 5, which could allow a remote unauthenticated user to execute arbitrary code with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.6.3-r1 | >= 1.6.3-r1 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. kadmind is the MIT Kerberos 5 administration daemon, KDC is the Key Distribution Center.
The first two vulnerabilities can be exploited by a remote unauthenticated attacker to execute arbitrary code on the host running krb5kdc, compromise the Kerberos key database or cause a Denial of Service. These bugs can only be triggered when Kerberos 4 support is enabled.
The RPC related vulnerability can be exploited by a remote unauthenticated attacker to crash kadmind, and theoretically execute arbitrary code with root privileges or cause database corruption. This bug can only be triggered in configurations that allow large numbers of open file descriptors in a process.
The GSSAPI vulnerabilities could be exploited by a remote attacker to cause Denial of Service conditions or possibly execute arbitrary code.
Kerberos 4 support can be disabled via disabling the "krb4" USE flag and recompiling the ebuild, or setting "v4_mode=none" in the [kdcdefaults] section of /etc/krb5/kdc.conf. This will only work around the KDC related vulnerabilities.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.6.3-r1"
Two vulnerabilities have been found in MIT Kerberos 5, which could allow a remote unauthenticated user to execute arbitrary code with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.5.3-r1 | >= 1.5.3-r1 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. kadmind is the MIT Kerberos 5 administration daemon.
A stack buffer overflow (CVE-2007-3999) has been reported in svcauth_gss_validate() of the RPC library of kadmind. Another vulnerability (CVE-2007-4000) has been found in kadm5_modify_policy_internal(), which does not check the return values of krb5_db_get_policy() correctly.
The RPC related vulnerability can be exploited by a remote unauthenticated attacker to execute arbitrary code with root privileges on the host running kadmind. The second vulnerability requires the remote attacker to be authenticated and to have "modify policy" privileges. It could then also allow for the remote execution of arbitrary code.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.5.3-r1"
Multiple vulnerabilities in MIT Kerberos 5 could potentially result in remote code execution with root privileges by unauthenticated users.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.5.2-r3 | >= 1.5.2-r3 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol.
kadmind is affected by multiple vulnerabilities in the RPC library shipped with MIT Kerberos 5. It fails to properly handle zero-length RPC credentials (CVE-2007-2442) and the RPC library can write past the end of the stack buffer (CVE-2007-2443). Furthermore kadmind fails to do proper bounds checking (CVE-2007-2798).
A remote unauthenticated attacker could exploit these vulnerabilities to execute arbitrary code with root privileges.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.5.2-r3"
Multiple vulnerabilities in MIT Kerberos 5 could potentially result in unauthenticated remote root code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.5.2-r1 | >= 1.5.2-r1 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol.
The Kerberos telnet daemon fails to properly handle usernames allowing unauthorized access to any account (CVE-2007-0956). The Kerberos administration daemon, the KDC and possibly other applications using the MIT Kerberos libraries are vulnerable to the following issues. The krb5_klog_syslog function from the kadm5 library fails to properly validate input leading to a stack overflow (CVE-2007-0957). The GSS-API library is vulnerable to a double-free attack (CVE-2007-1216).
By exploiting the telnet vulnerability a remote attacker may obtain access with root privileges. The remaining vulnerabilities may allow an authenticated remote attacker to execute arbitrary code with root privileges.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.5.2-r1"
Multiple vulnerabilities in MIT Kerberos 5 could potentially result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.5.2 | >= 1.5.2 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol.
The Kerberos administration daemon, and possibly other applications using the GSS-API or RPC libraries, could potentially call a function pointer in a freed heap buffer, or attempt to free an uninitialized pointer.
A remote attacker may be able to crash an affected application, or potentially execute arbitrary code with root privileges.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.5.2"
Some applications shipped with MIT Kerberos 5 are vulnerable to local privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.4.3-r3 | >= 1.4.3-r3 |
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.
Unchecked calls to setuid() in krshd and v4rcp, as well as unchecked calls to seteuid() in kftpd and in ksu, have been found in the MIT Kerberos 5 program suite and may lead to a local root privilege escalation.
A local attacker could exploit this vulnerability to execute arbitrary code with elevated privileges.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.4.3-r3"
MIT Kerberos 5 is vulnerable to a Denial of Service attack and remote execution of arbitrary code, possibly leading to the compromise of the entire Kerberos realm.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.4.1-r1 | >= 1.4.1-r1 |
MIT Kerberos 5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology.
Daniel Wachdorf discovered that MIT Kerberos 5 could corrupt the heap by freeing unallocated memory when receiving a special TCP request (CAN-2005-1174). He also discovered that the same request could lead to a single-byte heap overflow (CAN-2005-1175). Magnus Hagander discovered that krb5_recvauth() function of MIT Kerberos 5 might try to double-free memory (CAN-2005-1689).
Although exploitation is considered difficult, a remote attacker could exploit the single-byte heap overflow and the double-free vulnerability to execute arbitrary code, which could lead to the compromise of the whole Kerberos realm. A remote attacker could also use the heap corruption to cause a Denial of Service.
There are no known workarounds at this time.
All MIT Kerberos 5 users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.4.1-r1"
The mit-krb5 telnet client is vulnerable to two buffer overflows, which could allow a malicious telnet server operator to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.3.6-r2 | >= 1.3.6-r2 |
The MIT Kerberos 5 implementation provides a command line telnet client which is used for remote login via the telnet protocol.
A buffer overflow has been identified in the env_opt_add() function, where a response requiring excessive escaping can cause a heap-based buffer overflow. Another issue has been identified in the slc_add_reply() function, where a large number of SLC commands can overflow a fixed size buffer.
Successful exploitation would require a vulnerable user to connect to an attacker-controlled telnet host, potentially executing arbitrary code with the permissions of the telnet user on the client.
There is no known workaround at this time.
All mit-krb5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.3.6-r2"
The MIT Kerberos 5 administration library (libkadm5srv) contains a heap overflow that could lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.3.6 | >= 1.3.6 |
MIT krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology.
The MIT Kerberos 5 administration library libkadm5srv contains a heap overflow in the code handling password changing.
Under specific circumstances an attacker could execute arbitary code with the permissions of the user running mit-krb5, which could be the root user.
There is no known workaround at this time.
All mit-krb5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.3.6"
The send-pr.sh script, included in the mit-krb5 package, is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the utility.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | <= 1.3.5 | >= 1.3.5-r1, >= 1.3.4-r1 (revision) |
MIT krb5 is the free implementation of the Kerberos network authentication protocol written by the Massachusetts Institute of Technology.
The send-pr.sh script creates temporary files in world-writeable directories with predictable names.
A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When send-pr.sh is called, this would result in the file being overwritten with the rights of the user running the utility, which could be the root user.
There is no known workaround at this time.
All MIT krb5 users should upgrade to the latest version:
# emerge sync # emerge -pv ">=app-crypt/mit-krb5-1.3.4-r1" # emerge ">=app-crypt/mit-krb5-1.3.4-r1"
MIT krb5 contains several double-free vulnerabilities, potentially allowing the execution of arbitrary code, as well as a denial of service vulnerability.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | < 1.3.4 | >= 1.3.4 |
MIT krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology.
The implementation of the Key Distribution Center (KDC) and the MIT krb5 library contain double-free vulnerabilities, making client programs as well as application servers vulnerable.
The ASN.1 decoder library is vulnerable to a denial of service attack, including the KDC.
The double-free vulnerabilities could allow an attacker to execute arbitrary code on a KDC host and hosts running krb524d or vulnerable services. In the case of a KDC host, this can lead to a compromise of the entire Kerberos realm. Furthermore, an attacker impersonating a legitimate KDC or application server can potentially execute arbitrary code on authenticating clients.
An attacker can cause a denial of service for a KDC or application server and clients, the latter if impersonating a legitimate KDC or application server.
There is no known workaround at this time.
All mit-krb5 users should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=app-crypt/mit-krb5-1.3.4" # emerge ">=app-crypt/mit-krb5-1.3.4"
mit-krb5 contains multiple buffer overflows in the function krb5_aname_to_localname(). This could potentially lead to a complete remote system compromise.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/mit-krb5 | * | <= 1.3.3 | >= 1.3.3-r1 |
mit-krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology.
The library function krb5_aname_to_localname() contains multiple buffer overflows. This is only exploitable if explicit mapping or rules-based mapping is enabled. These are not enabled as default.
With explicit mapping enabled, an attacker must authenticate using a principal name listed in the explicit mapping list.
With rules-based mapping enabled, an attacker must first be able to create arbitrary principal names either in the local realm Kerberos realm or in a remote realm from which the local realm's service are reachable by cross-realm authentication.
An attacker could use these vulnerabilities to execute arbitrary code with the permissions of the user running mit-krb5, which could be the root user.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version.
mit-krb5 users should upgrade to the latest version:
# emerge sync # emerge -pv ">=app-crypt/mit-krb5-1.3.3-r1" # emerge ">=app-crypt/mit-krb5-1.3.3-r1"