In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.

This update for libheimdal to version 7.5.0 fixes the following issues :

The following security vulnerability was fixed :

  - CVE-2017-17439: Fixed a remote denial of service     vulnerability through which remote unauthenticated     attackers were able to crash the KDC by sending a     crafted UDP packet containing empty data fields for     client name or realm (boo#1071675)

The following other bugs were fixed :

  - Override the build date (boo#1047218)

  - Use constant hostname (boo#1084909)

  - Handle long input lines when reloading database dumps

  - In pre-forked mode, correctly clear the process ids of     exited children, allowing new child processes to replace     the old.

  - Fixed incorrect KDC response when no-cross realm TGT     exists, allowing client requests to fail quickly rather     than time out after trying to get a correct answer from     each KDC.

Update to 7.5.0 GA release (CVE-2017-17439)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libheimdal fixes the following issues :

  - CVE-2017-17439: Remote unauthenticated attackers may     have crashed the KDC (boo#1071675)

Michael Eder and Thomas Kittel discovered that Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos, did not correctly handle ASN.1 data. This would allow an unauthenticated remote attacker to cause a denial of service (crash of the KDC daemon) by sending maliciously crafted packets.

ID	Name	Product	Family	Severity
111811	openSUSE Security Update : libheimdal (openSUSE-2018-876)	Nessus	SuSE Local Security Checks	high
106000	Fedora 27 : heimdal (2017-f0e5ad250c)	Nessus	Fedora Local Security Checks	high
105706	Fedora 26 : heimdal (2017-2962e58478)	Nessus	Fedora Local Security Checks	high
105244	openSUSE Security Update : libheimdal (openSUSE-2017-1364)	Nessus	SuSE Local Security Checks	high
105087	Debian DSA-4055-1 : heimdal - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-17439

high

Tenable Plugins

high

high

high

high

high