CVE-2014-9423

Published: Feb 19, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.

Affected (10)

Products: Mit: Kerberos 5

1 product

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos 5	Version 1.11.1
Mit Kerberos 5	Version 1.11.2
Mit Kerberos 5	Version 1.11.3
Mit Kerberos 5	Version 1.11.4
Mit Kerberos 5	Version 1.11.5
Mit Kerberos 5	Version 1.11
Mit Kerberos 5	Version 1.12.1
Mit Kerberos 5	Version 1.12.2
Mit Kerberos 5	Version 1.12
Mit Kerberos 5	Version 1.13

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (26)

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-0439.html

Source: cve@mitre.org

http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt

Source: cve@mitre.org

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt

Source: cve@mitre.org

Vendor Advisory

http://www.debian.org/security/2015/dsa-3153

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2015:069

Source: cve@mitre.org

http://www.securityfocus.com/bid/72503

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2498-1

Source: cve@mitre.org

https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8dd22bc9526751610aaa255ead9c

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-0439.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.debian.org/security/2015/dsa-3153

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2015:069

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/72503

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2498-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8dd22bc9526751610aaa255ead9c

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.