CVE-2015-2697

MEDIUM · 4.0 CVSS Gepubliceerd: 09-11-2015 CWE-125

Beschrijving

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '' character in a long realm field within a TGS request.

Vendors

Mit Oracle Canonical Debian Opensuse Suse

Affected products

Kerberos 5 Solaris Ubuntu Linux Debian Linux Leap Opensuse Linux Enterprise Desktop Linux Enterprise Server Linux Enterprise Software Development Kit

References

krbdev.mit.edu
lists.opensuse.org
lists.opensuse.org
lists.opensuse.org
www.debian.org
www.oracle.com
www.securityfocus.com
www.securitytracker.com
www.ubuntu.com
github.com
security.gentoo.org