SB2011103104 - Amazon Linux AMI update for krb5
Published: October 31, 2011 Updated: May 27, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2011-1527)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a kinit operation with incorrect string case for the realm, related to the is_principal_in_realm, krb5_set_error_message, krb5_ldap_get_principal, and process_as_req functions.
2) Input validation error (CVE-ID: CVE-2011-1528)
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (assertion failure and daemon exit) via unspecified vectors, related to the locked_check_p function.
3) NULL pointer dereference (CVE-ID: CVE-2011-1529)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via vectors that trigger certain process_as_req errors.
Remediation
Install update from vendor's website.