CVE-2014-4344

Published: Aug 14, 2014Modified: May 6, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.

Affected (18)

Products: Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Server, Enterprise Linux Workstation · Mit: Kerberos 5

1 product

4 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Server

Enterprise Linux Workstation

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration C

13 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos 5	Version 1.10.1
Mit Kerberos 5	Version 1.10.2
Mit Kerberos 5	Version 1.10.3
Mit Kerberos 5	Version 1.10.4
Mit Kerberos 5	Version 1.10
Mit Kerberos 5	Version 1.11.1
Mit Kerberos 5	Version 1.11.2
Mit Kerberos 5	Version 1.11.3
Mit Kerberos 5	Version 1.11.4
Mit Kerberos 5	Version 1.11.5
Mit Kerberos 5	Version 1.11
Mit Kerberos 5	Version 1.12.1
Mit Kerberos 5	Version 1.12

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (38)

http://advisories.mageia.org/MGASA-2014-0345.html

Source: cve@mitre.org

http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc

Source: cve@mitre.org

http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970

Source: cve@mitre.org

Issue TrackingThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-0439.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/59102

Source: cve@mitre.org

http://secunia.com/advisories/60082

Source: cve@mitre.org

http://secunia.com/advisories/60448

Source: cve@mitre.org

http://secunia.com/advisories/61051

Source: cve@mitre.org

http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15561.html

Source: cve@mitre.org

http://www.debian.org/security/2014/dsa-3000

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2014:165

Source: cve@mitre.org

http://www.osvdb.org/109389

Source: cve@mitre.org

http://www.securityfocus.com/bid/69160

Source: cve@mitre.org

http://www.securitytracker.com/id/1030706

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=1121877

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/95210

Source: cve@mitre.org

https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b

Source: cve@mitre.org

https://github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edc

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

http://advisories.mageia.org/MGASA-2014-0345.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc

Source: af854a3a-2127-422b-91ae-364da2661108

http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-0439.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://secunia.com/advisories/59102

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/60082

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/60448

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/61051

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15561.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-3000

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2014:165

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/109389

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/69160

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1030706

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1121877

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/95210

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edc

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.