Advisories » MGASA-2013-0336

Updated krb5 package fixes security vulnerabilities

Publication date: 20 Nov 2013
Modification date: 20 Nov 2013
Type: security
Affected Mageia releases : 3
CVE: CVE-2013-1417 , CVE-2013-1418

Description

An authenticated remote client can cause a KDC to crash by making a valid
TGS-REQ to a KDC serving a realm with a single-component name. The
process_tgs_req() function dereferences a null pointer because an unusual
failure condition causes a helper function to return success
(CVE-2013-1417).

If a KDC serves multiple realms, certain requests can cause
setup_server_realm() to dereference a null pointer, crashing the KDC.
This   can be triggered by an unauthenticated user (CVE-2013-1418).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=11668
• http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1418
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1417
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1418

SRPMS

3/core

• krb5-1.11.1-1.3.mga3