FreeBSD : krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 (24ce5597-acab-11e4-a847-206a8a720317)

High Nessus Plugin ID 81175


The remote FreeBSD host is missing one or more security-related updates.


SO-AND-SO reports :

CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind are vulnerable as they can be instructed to call gss_process_context_token().

CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may perform use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications may also be vulnerable if they contain insufficiently defensive XDR functions.

CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts authentications to two-component server principals whose first component is a left substring of 'kadmin' or whose realm is a left prefix of the default realm.

CVE-2014-9423: libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused 'handle' field in replies to clients.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 81175

File Name: freebsd_pkg_24ce5597acab11e4a847206a8a720317.nasl

Version: $Revision: 1.5 $

Type: local

Published: 2015/02/05

Modified: 2015/05/31

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:krb5, p-cpe:/a:freebsd:freebsd:krb5-111, p-cpe:/a:freebsd:freebsd:krb5-112, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2015/02/04

Vulnerability Publication Date: 2015/02/03

Reference Information

CVE: CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423