Input validation error in Kerberos 5 - CVE-2014-5355

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU40884

Input validation error in Kerberos 5 - CVE-2014-5355

Published: February 20, 2015 / Updated: May 27, 2022


Vulnerability identifier: #VU40884
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-5355
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.


Affected software

Kerberos 5
Amazon Linux AMI
Ubuntu
Fedora
krb5-kdc (Ubuntu package)
krb5-user (Ubuntu package)
libkrb5support0 (Ubuntu package)
krb5-kdc-ldap (Ubuntu package)
krb5-admin-server (Ubuntu package)
libkrb5-3 (Ubuntu package)
libkadm5clnt-mit8 (Ubuntu package)
libk5crypto3 (Ubuntu package)
libgssrpc4 (Ubuntu package)
krb5-pkinit (Ubuntu package)
libkrb53 (Ubuntu package)
libgssapi-krb5-2 (Ubuntu package)
libkdb5-6 (Ubuntu package)
libkdb5-7 (Ubuntu package)
libkrad0 (Ubuntu package)
libkadm5clnt-mit9 (Ubuntu package)
krb5-otp (Ubuntu package)
krb5-k5tls (Ubuntu package)
libkdb5-8 (Ubuntu package)
krb5

How to mitigate CVE-2014-5355

Install update from vendor's website.

krb5-kdc (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
krb5-user (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
libkrb5support0 (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
krb5-kdc-ldap (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
krb5-admin-server (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
libkrb5-3 (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
libkadm5clnt-mit8 (Ubuntu package) - update to 1.10+dfsg~beta1-2ubuntu0.7
libk5crypto3 (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
libgssrpc4 (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
krb5-pkinit (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
libkrb53 (Ubuntu package) - update to 1.10+dfsg~beta1-2ubuntu0.7
libgssapi-krb5-2 (Ubuntu package) - addressed in versions 1.10+dfsg~beta1-2ubuntu0.7, 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
libkdb5-6 (Ubuntu package) - update to 1.10+dfsg~beta1-2ubuntu0.7
libkdb5-7 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1
libkrad0 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
libkadm5clnt-mit9 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
krb5-otp (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.2, 1.12.1+dfsg-18ubuntu0.1, 1.13.2+dfsg-2ubuntu0.1
krb5-k5tls (Ubuntu package) - update to 1.13.2+dfsg-2ubuntu0.1
libkdb5-8 (Ubuntu package) - update to 1.13.2+dfsg-2ubuntu0.1
krb5 - update to 1.13.1-2.fc22

External References

Related Security Bulletins