lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.

The remote host is affected by the vulnerability described in GLSA-201611-14 (MIT Kerberos 5: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The krb5 package was updated to fix the following security and non security issues :

  - CVE-2015-2695: Fixed missing functions that were still     vulnerable (bsc#954270).

  - Fixed a memory leak in the handling of error messages     (bsc#954470).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

krb5 was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-2695: Applications which call     gss_inquire_context() on a partially-established SPNEGO     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952188).

  - CVE-2015-2696: Applications which call     gss_inquire_context() on a partially-established IAKERB     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952189).

  - CVE-2015-2697: Incorrect string handling in     build_principal_va can lead to DOS (bsc#952190).

It was discovered that the Kerberos kpasswd service incorrectly handled certain UDP packets. A remote attacker could possibly use this issue to cause resource consumption, resulting in a denial of service.
This issue only affected Ubuntu 12.04 LTS. (CVE-2002-2443)

It was discovered that Kerberos incorrectly handled null bytes in certain data fields. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-5355)

It was discovered that the Kerberos kdcpreauth modules incorrectly tracked certain client requests. A remote attacker could possibly use this issue to bypass intended preauthentication requirements. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2694)

It was discovered that Kerberos incorrectly handled certain SPNEGO packets. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2695)

It was discovered that Kerberos incorrectly handled certain IAKERB packets. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2696, CVE-2015-2698)

It was discovered that Kerberos incorrectly handled certain TGS requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2697).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in krb5, the MIT implementation of Kerberos. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-2695     It was discovered that applications which call     gss_inquire_context() on a partially-established SPNEGO     context can cause the GSS-API library to read from a     pointer using the wrong type, leading to a process     crash.

  - CVE-2015-2696     It was discovered that applications which call     gss_inquire_context() on a partially-established IAKERB     context can cause the GSS-API library to read from a     pointer using the wrong type, leading to a process     crash.

  - CVE-2015-2697     It was discovered that the build_principal_va() function     incorrectly handles input strings. An authenticated     attacker can take advantage of this flaw to cause a KDC     to crash using a TGS request with a large realm field     beginning with a null byte.

CVE-2015-2695

It was discovered that applications which call gss_inquire_context() on a partially-established SPNEGO context can cause the GSS-API library to read from a pointer using the wrong type, leading to a process crash.

CVE-2015-2697

It was discovered that the build_principal_va() function incorrectly handles input strings. An authenticated attacker can take advantage of this flaw to cause a KDC to crash using a TGS request with a large realm field beginning with a null byte.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 1.8.3+dfsg-4squeeze10.

We recommend that you upgrade your krb5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

krb5 was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-2695: Applications which call     gss_inquire_context() on a partially-established SPNEGO     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash (bsc#952188).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

krb5 was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-2695: Applications which call     gss_inquire_context() on a partially-established SPNEGO     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952188).

  - CVE-2015-2696: Applications which call     gss_inquire_context() on a partially-established IAKERB     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952189).

  - CVE-2015-2697: Incorrect string handling in     build_principal_va can lead to DOS (bsc#952190).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
95021	GLSA-201611-14 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
87496	SUSE SLED11 / SLES11 Security Update : krb5 (SUSE-SU-2015:2294-1)	Nessus	SuSE Local Security Checks	high
86963	openSUSE Security Update : krb5 (openSUSE-2015-740)	Nessus	SuSE Local Security Checks	high
86872	Ubuntu 14.04 LTS : Kerberos vulnerabilities (USN-2810-1)	Nessus	Ubuntu Local Security Checks	high
86800	openSUSE Security Update : krb5 (openSUSE-2015-709)	Nessus	SuSE Local Security Checks	high
86795	Debian DSA-3395-1 : krb5 - security update	Nessus	Debian Local Security Checks	high
86793	Debian DLA-340-1 : krb5 security update	Nessus	Debian Local Security Checks	high
86755	SUSE SLED11 / SLES11 Security Update : krb5 (SUSE-SU-2015:1898-1)	Nessus	SuSE Local Security Checks	high
86754	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2015:1897-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-2695

high

Tenable Plugins

high

high

high

high

high

high

high

high

high