SB2013041901 - NULL pointer dereference in MIT Kerberos 5
Published: April 19, 2013 Updated: May 27, 2022
Security Bulletin ID
SB2013041901
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2013-1416)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted TGS-REQ request.
Remediation
Install update from vendor's website.
References
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=7600
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102058.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102074.html
- http://lists.opensuse.org/opensuse-updates/2013-05/msg00011.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00041.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00102.html
- http://rhn.redhat.com/errata/RHSA-2013-0748.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:157
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:158
- https://github.com/krb5/krb5/commit/8ee70ec63931d1e38567905387ab9b1d45734d81