var-201408-0300
Vulnerability from variot
Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of "cpw -keepold" commands. MIT kerberos 5 is prone to a buffer overflow vulnerability due to a out-of-bounds write memory access condition. Attackers can exploit this issue to execute arbitrary code within the context of the user. Failed attempts will likely cause a denial-of-service condition. MIT kerberos 5 1.6 through 1.12.1 are vulnerable.
CVE-2014-4343
An unauthenticated remote attacker with the ability to spoof packets
appearing to be from a GSSAPI acceptor can cause a double-free
condition in GSSAPI initiators (clients) which are using the SPNEGO
mechanism, by returning a different underlying mechanism than was
proposed by the initiator.
CVE-2014-4344
An unauthenticated or partially authenticated remote attacker can
cause a NULL dereference and application crash during a SPNEGO
negotiation by sending an empty token as the second or later context
token from initiator to acceptor.
For the stable distribution (wheezy), these problems have been fixed in version 1.10.1+dfsg-5+deb7u2.
For the unstable distribution (sid), these problems have been fixed in version 1.12.1+dfsg-7. ========================================================================== Ubuntu Security Notice USN-2310-1 August 11, 2014
krb5 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Kerberos. This issue only affected Ubuntu 12.04 LTS. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2014-4344)
Tomas Kuthan and Greg Hudson discovered that the Kerberos kadmind daemon incorrectly handled buffers when used with the LDAP backend. (CVE-2014-4345)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.04 LTS: krb5-admin-server 1.12+dfsg-2ubuntu4.2 krb5-kdc 1.12+dfsg-2ubuntu4.2 krb5-kdc-ldap 1.12+dfsg-2ubuntu4.2 krb5-otp 1.12+dfsg-2ubuntu4.2 krb5-pkinit 1.12+dfsg-2ubuntu4.2 krb5-user 1.12+dfsg-2ubuntu4.2 libgssapi-krb5-2 1.12+dfsg-2ubuntu4.2 libgssrpc4 1.12+dfsg-2ubuntu4.2 libk5crypto3 1.12+dfsg-2ubuntu4.2 libkadm5clnt-mit9 1.12+dfsg-2ubuntu4.2 libkadm5srv-mit9 1.12+dfsg-2ubuntu4.2 libkdb5-7 1.12+dfsg-2ubuntu4.2 libkrad0 1.12+dfsg-2ubuntu4.2 libkrb5-3 1.12+dfsg-2ubuntu4.2 libkrb5support0 1.12+dfsg-2ubuntu4.2
Ubuntu 12.04 LTS: krb5-admin-server 1.10+dfsg~beta1-2ubuntu0.5 krb5-kdc 1.10+dfsg~beta1-2ubuntu0.5 krb5-kdc-ldap 1.10+dfsg~beta1-2ubuntu0.5 krb5-pkinit 1.10+dfsg~beta1-2ubuntu0.5 krb5-user 1.10+dfsg~beta1-2ubuntu0.5 libgssapi-krb5-2 1.10+dfsg~beta1-2ubuntu0.5 libgssrpc4 1.10+dfsg~beta1-2ubuntu0.5 libk5crypto3 1.10+dfsg~beta1-2ubuntu0.5 libkadm5clnt-mit8 1.10+dfsg~beta1-2ubuntu0.5 libkadm5srv-mit8 1.10+dfsg~beta1-2ubuntu0.5 libkdb5-6 1.10+dfsg~beta1-2ubuntu0.5 libkrb5-3 1.10+dfsg~beta1-2ubuntu0.5 libkrb5support0 1.10+dfsg~beta1-2ubuntu0.5
Ubuntu 10.04 LTS: krb5-admin-server 1.8.1+dfsg-2ubuntu0.13 krb5-kdc 1.8.1+dfsg-2ubuntu0.13 krb5-kdc-ldap 1.8.1+dfsg-2ubuntu0.13 krb5-pkinit 1.8.1+dfsg-2ubuntu0.13 krb5-user 1.8.1+dfsg-2ubuntu0.13 libgssapi-krb5-2 1.8.1+dfsg-2ubuntu0.13 libgssrpc4 1.8.1+dfsg-2ubuntu0.13 libk5crypto3 1.8.1+dfsg-2ubuntu0.13 libkadm5clnt-mit7 1.8.1+dfsg-2ubuntu0.13 libkadm5srv-mit7 1.8.1+dfsg-2ubuntu0.13 libkdb5-4 1.8.1+dfsg-2ubuntu0.13 libkrb5-3 1.8.1+dfsg-2ubuntu0.13 libkrb5support0 1.8.1+dfsg-2ubuntu0.13
In general, a standard system update will make all the necessary changes.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4341 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4342 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4344 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4345 http://advisories.mageia.org/MGASA-2014-0345.html
Updated Packages:
Mandriva Business Server 1/X86_64: 3d717913ec53cd745cbaa0ea46321815 mbs1/x86_64/krb5-1.9.2-3.5.mbs1.x86_64.rpm e11b2338f4265d9241013211644543d9 mbs1/x86_64/krb5-pkinit-openssl-1.9.2-3.5.mbs1.x86_64.rpm 3dd7ce5af9b798a3be7fb22f3598e3a7 mbs1/x86_64/krb5-server-1.9.2-3.5.mbs1.x86_64.rpm a86c6a16fa6091672020b97d5873fc7f mbs1/x86_64/krb5-server-ldap-1.9.2-3.5.mbs1.x86_64.rpm c56d0f9b2f4f5b7145db65efd8d3627f mbs1/x86_64/krb5-workstation-1.9.2-3.5.mbs1.x86_64.rpm 67a0a6fc9192328cedd811db760089b4 mbs1/x86_64/lib64krb53-1.9.2-3.5.mbs1.x86_64.rpm ff121251269cab55a574bc5a06c739b0 mbs1/x86_64/lib64krb53-devel-1.9.2-3.5.mbs1.x86_64.rpm 0308ef62a73141b5f0915251796608c7 mbs1/SRPMS/krb5-1.9.2-3.5.mbs1.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
MITKRB5-SA-2014-001
MIT krb5 Security Advisory 2014-001 Original release: 2014-08-07 Last update: 2014-08-07
Topic: Buffer overrun in kadmind with LDAP backend
CVSSv2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C
CVSSv2 Base Score: 8.5
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
CVSSv2 Temporal Score: 6.7
Exploitability: Proof-of-Concept Remediation Level: Official Fix Report Confidence: Confirmed
SUMMARY
In MIT krb5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause it to perform an out-of-bounds write (buffer overflow). This is not a protocol vulnerability. Using LDAP for the KDC database is a non-default configuration for the KDC.
IMPACT
Historically, it has been possible to convert an out-of-bounds write into remote code execution in some cases, though the necessary exploits must be tailored to the individual application and are usually quite complicated. Depending on the allocated length of the array, an out-of-bounds write may also cause a segmentation fault and/or application crash.
AFFECTED SOFTWARE
- The kadmind daemon from MIT krb5 releases 1.6 to 1.12.2, when configured to use the LDAP backend for the KDB, is vulnerable. Releases of MIT krb5 prior to 1.6 did not provide the ability to use LDAP for the KDB backend.
FIXES
-
Workaround: disable or restrict access to kadmind until a patched version can be installed. This will prevent principal creation, password changes, keytab updates, and other administrative operations.
-
The krb5-1.12.2 and krb5-1.11.6 releases will contain a fix for this vulnerability.
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c index ce851ea..df5934c 100644 - --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c @@ -456,7 +456,8 @@ krb5_encode_krbsecretkey(krb5_key_data *key_data_in, int n_key_data, j++; last = i + 1;
-
- currkvno = key_data[i].key_data_kvno;
- if (i < n_key_data - 1)
- currkvno = key_data[i + 1].key_data_kvno; } } ret[num_versions] = NULL;
This patch is also available at
http://web.mit.edu/kerberos/advisories/2014-001-patch.txt
A PGP-signed patch is available at
http://web.mit.edu/kerberos/advisories/2014-001-patch.txt.asc
REFERENCES
This announcement is posted at:
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2014-001.txt
This announcement and related security advisories may be found on the MIT Kerberos security advisory page at:
http://web.mit.edu/kerberos/advisories/index.html
The main MIT Kerberos web page is at:
http://web.mit.edu/kerberos/index.html
CVSSv2:
http://www.first.org/cvss/cvss-guide.html
http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
CVE: CVE-2014-4345 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4345
ACKNOWLEDGMENTS
This off-by-one error was reported by Tomas Kuthan as github pull request #181 and recognized as a vulnerability by Greg Hudson. When sending sensitive information, please PGP-encrypt it using the following key:
pub 2048R/C436A9C6 2014-01-07 [expires: 2015-02-01] Key fingerprint = 1849 02FF 0CA8 A385 F28D 2E7E 2AF0 C1EA C436 A9C6 uid MIT Kerberos Team Security Contact krbcore-security@mit.edu
DETAILS
The 'cpw -keepold' functionality allows for the existing keys to be retained at password-change (or keytab-change) time, instead of being discarded as usual. An array must be allocated to store all the old keys, as well as the new keys and a NULL terminator. In normal operation, all the keys for a single kvno will share an array slot. An off-by-one error while copying key information to the new array results in keys sharing a common kvno being written to different array buckets, with the first key of a kvno betting a single bucket, and the remaining keys getting the next bucket. After sufficient iterations, the extra writes extend past the end of the (NULL-terminated) array. The NULL terminator is always written after the end of the loop, so no out-of-bounds data is read, it is only written.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-crypt/mit-krb5 < 1.13 >= 1.13
Description
Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please review the CVE identifiers referenced below for details.
Workaround
There is no known workaround at this time.
Resolution
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.13"
References
[ 1 ] CVE-2014-4341 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4341 [ 2 ] CVE-2014-4343 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4343 [ 3 ] CVE-2014-4345 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4345 [ 4 ] CVE-2014-5351 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5351
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201412-53.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: krb5 security, bug fix and enhancement update Advisory ID: RHSA-2015:0439-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0439.html Issue date: 2015-03-05 CVE Names: CVE-2014-4341 CVE-2014-4342 CVE-2014-4343 CVE-2014-4344 CVE-2014-4345 CVE-2014-5352 CVE-2014-5353 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 =====================================================================
- Summary:
Updated krb5 packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Kerberos is a networked authentication system which allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos KDC.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64
- Description:
A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. A remote, unauthenticated attacker could use this flaw to crash a GSSAPI-enabled server application. (CVE-2014-4344)
A buffer overflow was found in the KADM5 administration server (kadmind) when it was used with an LDAP back end for the KDC database. (CVE-2014-4345)
A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library (libgssapi) call the gss_process_context_token() function could use this flaw to crash that application. (CVE-2014-5352)
If kadmind were used with an LDAP back end for the KDC database, a remote, authenticated attacker with the permissions to set the password policy could crash kadmind by attempting to use a named ticket policy object as a password policy for a principal. (CVE-2014-5353)
A double-free flaw was found in the way MIT Kerberos handled invalid External Data Representation (XDR) data. An authenticated user could use this flaw to crash the MIT Kerberos administration server (kadmind), or other applications using Kerberos libraries, using specially crafted XDR packets. (CVE-2014-9421)
It was found that the MIT Kerberos administration server (kadmind) incorrectly accepted certain authentication requests for two-component server principal names. A remote attacker able to acquire a key with a particularly named principal (such as "kad/x") could use this flaw to impersonate any user to kadmind, and perform administrative actions as that user. (CVE-2014-9422)
An information disclosure flaw was found in the way MIT Kerberos RPCSEC_GSS implementation (libgssrpc) handled certain requests. An attacker could send a specially crafted request to an application using libgssrpc to disclose a limited portion of uninitialized memory used by that application. (CVE-2014-9423)
Two buffer over-read flaws were found in the way MIT Kerberos handled certain requests. A remote, unauthenticated attacker able to inject packets into a client or server application's GSSAPI session could use either of these flaws to crash the application. An attacker able to spoof packets to appear as though they are from an GSSAPI acceptor could use this flaw to crash a client application that uses MIT Kerberos. (CVE-2014-4343)
Red Hat would like to thank the MIT Kerberos project for reporting the CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, and CVE-2014-9423 issues. MIT Kerberos project acknowledges Nico Williams for helping with the analysis of CVE-2014-5352.
The krb5 packages have been upgraded to upstream version 1.12, which provides a number of bug fixes and enhancements, including:
-
Added plug-in interfaces for principal-to-username mapping and verifying authorization to user accounts.
-
When communicating with a KDC over a connected TCP or HTTPS socket, the client gives the KDC more time to reply before it transmits the request to another server. (BZ#1049709, BZ#1127995)
This update also fixes multiple bugs, for example:
- The Kerberos client library did not recognize certain exit statuses that the resolver libraries could return when looking up the addresses of servers configured in the /etc/krb5.conf file or locating Kerberos servers using DNS service location. The library could treat non-fatal return codes as fatal errors. Now, the library interprets the specific return codes correctly. (BZ#1084068, BZ#1109102)
In addition, this update adds various enhancements. Among others:
-
Added support for contacting KDCs and kpasswd servers through HTTPS proxies implementing the Kerberos KDC Proxy (KKDCP) protocol. (BZ#1109919)
-
Solution:
All krb5 users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1084068 - ipv6 address handling in krb5.conf 1102837 - Please backport improved GSSAPI mech configuration 1109102 - Kerberos does not handle incorrect Active Directory DNS SRV entries correctly 1109919 - Backport https support into libkrb5 1116180 - CVE-2014-4341 krb5: denial of service flaws when handling padding length longer than the plaintext 1118347 - ksu non-functional, gets invalid argument copying cred cache 1120581 - CVE-2014-4342 krb5: denial of service flaws when handling RFC 1964 tokens 1121789 - CVE-2014-4343: use-after-free crash in SPNEGO 1121876 - CVE-2014-4343 krb5: double-free flaw in SPNEGO initiators 1121877 - CVE-2014-4344 krb5: NULL pointer dereference flaw in SPNEGO acceptor for continuation tokens 1127995 - aggressive kinit timeout causes AS_REQ resent and subsequent OTP auth failure 1128157 - CVE-2014-4345 krb5: buffer overrun in kadmind with LDAP backend (MITKRB5-SA-2014-001) 1166012 - libkadmclnt SONAME change (8 to 9) in krb5 1.12 update 1174543 - CVE-2014-5353 krb5: NULL pointer dereference when using a ticket policy name as a password policy name 1179856 - CVE-2014-5352 krb5: gss_process_context_token() incorrectly frees context (MITKRB5-SA-2015-001) 1179857 - CVE-2014-9421 krb5: kadmind doubly frees partial deserialization results (MITKRB5-SA-2015-001) 1179861 - CVE-2014-9422 krb5: kadmind incorrectly validates server principal name (MITKRB5-SA-2015-001) 1179863 - CVE-2014-9423 krb5: libgssrpc server applications leak uninitialized bytes (MITKRB5-SA-2015-001) 1184629 - kinit loops on principals on unknown error
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source: krb5-1.12.2-14.el7.src.rpm
x86_64: krb5-debuginfo-1.12.2-14.el7.i686.rpm krb5-debuginfo-1.12.2-14.el7.x86_64.rpm krb5-libs-1.12.2-14.el7.i686.rpm krb5-libs-1.12.2-14.el7.x86_64.rpm krb5-pkinit-1.12.2-14.el7.x86_64.rpm krb5-workstation-1.12.2-14.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: krb5-debuginfo-1.12.2-14.el7.i686.rpm krb5-debuginfo-1.12.2-14.el7.x86_64.rpm krb5-devel-1.12.2-14.el7.i686.rpm krb5-devel-1.12.2-14.el7.x86_64.rpm krb5-server-1.12.2-14.el7.x86_64.rpm krb5-server-ldap-1.12.2-14.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: krb5-1.12.2-14.el7.src.rpm
x86_64: krb5-debuginfo-1.12.2-14.el7.i686.rpm krb5-debuginfo-1.12.2-14.el7.x86_64.rpm krb5-libs-1.12.2-14.el7.i686.rpm krb5-libs-1.12.2-14.el7.x86_64.rpm krb5-pkinit-1.12.2-14.el7.x86_64.rpm krb5-workstation-1.12.2-14.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: krb5-debuginfo-1.12.2-14.el7.i686.rpm krb5-debuginfo-1.12.2-14.el7.x86_64.rpm krb5-devel-1.12.2-14.el7.i686.rpm krb5-devel-1.12.2-14.el7.x86_64.rpm krb5-server-1.12.2-14.el7.x86_64.rpm krb5-server-ldap-1.12.2-14.el7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: krb5-1.12.2-14.el7.src.rpm
ppc64: krb5-debuginfo-1.12.2-14.el7.ppc.rpm krb5-debuginfo-1.12.2-14.el7.ppc64.rpm krb5-devel-1.12.2-14.el7.ppc.rpm krb5-devel-1.12.2-14.el7.ppc64.rpm krb5-libs-1.12.2-14.el7.ppc.rpm krb5-libs-1.12.2-14.el7.ppc64.rpm krb5-pkinit-1.12.2-14.el7.ppc64.rpm krb5-server-1.12.2-14.el7.ppc64.rpm krb5-server-ldap-1.12.2-14.el7.ppc64.rpm krb5-workstation-1.12.2-14.el7.ppc64.rpm
s390x: krb5-debuginfo-1.12.2-14.el7.s390.rpm krb5-debuginfo-1.12.2-14.el7.s390x.rpm krb5-devel-1.12.2-14.el7.s390.rpm krb5-devel-1.12.2-14.el7.s390x.rpm krb5-libs-1.12.2-14.el7.s390.rpm krb5-libs-1.12.2-14.el7.s390x.rpm krb5-pkinit-1.12.2-14.el7.s390x.rpm krb5-server-1.12.2-14.el7.s390x.rpm krb5-server-ldap-1.12.2-14.el7.s390x.rpm krb5-workstation-1.12.2-14.el7.s390x.rpm
x86_64: krb5-debuginfo-1.12.2-14.el7.i686.rpm krb5-debuginfo-1.12.2-14.el7.x86_64.rpm krb5-devel-1.12.2-14.el7.i686.rpm krb5-devel-1.12.2-14.el7.x86_64.rpm krb5-libs-1.12.2-14.el7.i686.rpm krb5-libs-1.12.2-14.el7.x86_64.rpm krb5-pkinit-1.12.2-14.el7.x86_64.rpm krb5-server-1.12.2-14.el7.x86_64.rpm krb5-server-ldap-1.12.2-14.el7.x86_64.rpm krb5-workstation-1.12.2-14.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: krb5-1.12.2-14.el7.src.rpm
x86_64: krb5-debuginfo-1.12.2-14.el7.i686.rpm krb5-debuginfo-1.12.2-14.el7.x86_64.rpm krb5-devel-1.12.2-14.el7.i686.rpm krb5-devel-1.12.2-14.el7.x86_64.rpm krb5-libs-1.12.2-14.el7.i686.rpm krb5-libs-1.12.2-14.el7.x86_64.rpm krb5-pkinit-1.12.2-14.el7.x86_64.rpm krb5-server-1.12.2-14.el7.x86_64.rpm krb5-server-ldap-1.12.2-14.el7.x86_64.rpm krb5-workstation-1.12.2-14.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2014-4341 https://access.redhat.com/security/cve/CVE-2014-4342 https://access.redhat.com/security/cve/CVE-2014-4343 https://access.redhat.com/security/cve/CVE-2014-4344 https://access.redhat.com/security/cve/CVE-2014-4345 https://access.redhat.com/security/cve/CVE-2014-5352 https://access.redhat.com/security/cve/CVE-2014-5353 https://access.redhat.com/security/cve/CVE-2014-9421 https://access.redhat.com/security/cve/CVE-2014-9422 https://access.redhat.com/security/cve/CVE-2014-9423 https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iD8DBQFU+GoxXlSAg2UNWIIRAtkZAJ9PYyHLsR1t+YWgqw4jb4XTtX8iuACgkxfi gZD8EL2lSaLXnIQxca8zLTg= =aK0y -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 6) - i386, x86_64
It was found that if a KDC served multiple realms, certain requests could cause the setup_server_realm() function to dereference a NULL pointer. (CVE-2014-4343)
These updated krb5 packages also include several bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.6 Technical Notes, linked to in the References section, for information on the most significant of these changes
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201408-0300",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.9.3"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.10"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.6.2"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.11.1"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.12"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.12.1"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.11.5"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.11"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.10.4"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.9"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.8"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.10.1"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.11.3"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.11.4"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.10.2"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.9.1"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.9.4"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.7"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.8.6"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.10.3"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.11.2"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.8.1"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.8.2"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.8.4"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.8.3"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.7.1"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.9.2"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.6.1"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.6"
},
{
"model": "kerberos 5",
"scope": "eq",
"trust": 1.0,
"vendor": "mit",
"version": "1.8.5"
},
{
"model": "kerberos",
"scope": "lt",
"trust": 0.8,
"vendor": "mit kerberos",
"version": "1.6.x from 1.11.x"
},
{
"model": "kerberos",
"scope": "lt",
"trust": 0.8,
"vendor": "mit kerberos",
"version": "1.12.x"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.8,
"vendor": "mit kerberos",
"version": "5 1.11.6"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.8,
"vendor": "mit kerberos",
"version": "5 1.12.2"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.10.3"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.9.2"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.12"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.11.5"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.11.4"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.10.2"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.12.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.11.3"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.10.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.6,
"vendor": "mit",
"version": "5-1.10"
},
{
"model": "aura collaboration environment",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.0"
},
{
"model": "big-ip wom hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip gtm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "big-ip apm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.11.4"
},
{
"model": "big-ip webaccelerator hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip gtm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6.0"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "big-ip link controller hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6.0"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-iq device",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.2"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.0"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip asm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "linux enterprise software development kit sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "big-ip edge gateway hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip apm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "krb5",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "1.12.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.10.1"
},
{
"model": "big-ip ltm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip psm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "business server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "1"
},
{
"model": "aura experience portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "55-1.8.3"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip apm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip ltm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip webaccelerator hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.0"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "2.1"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.40"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.4"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.10.3"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip ltm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip analytics hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip link controller hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip link controller hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "communications webrtc session controller",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "7.0"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.3"
},
{
"model": "linux enterprise server sp3 for vmware",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "big-ip asm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip ltm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.3"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.2"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "3.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "55-1.9"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip gtm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.12"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "big-ip ltm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6.0"
},
{
"model": "big-ip analytics hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "55-1.8.1"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip gtm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.11"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip link controller hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "enterprise linux desktop client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "big-iq device",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.3"
},
{
"model": "big-ip edge gateway hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.0"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip ltm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "ip office server edition",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "9.0"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.00"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "big-ip asm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0.0"
},
{
"model": "big-ip psm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip gtm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip apm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip psm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip wom hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-ip asm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.9.2"
},
{
"model": "cms r17",
"scope": null,
"trust": 0.3,
"vendor": "avaya",
"version": null
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.9.3"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "7"
},
{
"model": "big-ip link controller hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.00"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "big-ip edge gateway hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.1"
},
{
"model": "big-ip webaccelerator hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "linux enterprise server sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip wom hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "big-ip link controller hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip edge gateway hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "aura conferencing",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.0"
},
{
"model": "big-iq security",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.3"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.10.2"
},
{
"model": "big-ip psm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip webaccelerator hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip wom hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.8.5"
},
{
"model": "big-ip analytics 11.0.0-hf2",
"scope": null,
"trust": 0.3,
"vendor": "f5",
"version": null
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip afm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "ip office server edition",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.11.3"
},
{
"model": "big-ip asm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "one-x client enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "big-ip analytics hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip analytics hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip edge gateway hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip apm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "51.6"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.3.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "5"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip psm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip ltm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.9.1"
},
{
"model": "business server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "1x8664"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip apm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "aura collaboration environment",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "2.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.10"
},
{
"model": "linux enterprise desktop sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "big-ip asm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.1.1"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6.0"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.00"
},
{
"model": "bladecenter advanced management module 3.66g",
"scope": null,
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip link controller hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip ltm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-iq cloud",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.0"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip apm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "krb5",
"scope": "ne",
"trust": 0.3,
"vendor": "mit",
"version": "1.12.2"
},
{
"model": "big-ip gtm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.0"
},
{
"model": "big-ip link controller hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6.0"
},
{
"model": "aura experience portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.2"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"model": "big-ip wom hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "55-1.7.1"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-iq cloud",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.2"
},
{
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "14.04"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.8.6"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.11.5"
},
{
"model": "big-ip asm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.00"
},
{
"model": "big-ip analytics hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.12.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "55-1.7"
},
{
"model": "big-ip gtm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-iq cloud",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.1"
},
{
"model": "big-ip webaccelerator hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip gtm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.3.3"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip link controller hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip asm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura experience portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "kerberos",
"scope": "ne",
"trust": 0.3,
"vendor": "mit",
"version": "51.11.6"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.11.2"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.8.4"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-ip psm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "solaris",
"scope": "ne",
"trust": 0.3,
"vendor": "oracle",
"version": "11.2.4.6.0"
},
{
"model": "big-ip apm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.10.4"
},
{
"model": "big-ip analytics hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.11.1"
},
{
"model": "big-ip psm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "centos",
"scope": "eq",
"trust": 0.3,
"vendor": "centos",
"version": "5"
},
{
"model": "big-ip asm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "51.6.2"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "big-ip webaccelerator hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "11.2"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "45-1.9.4"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "big-ip apm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura experience portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.1"
},
{
"model": "big-ip analytics hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0.00"
},
{
"model": "big-ip asm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip ltm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "55-1.8.2"
},
{
"model": "big-iq security",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.0"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "55-1.8"
},
{
"model": "big-ip analytics hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "2.3"
},
{
"model": "big-ip psm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6.0"
},
{
"model": "big-ip gtm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-iq cloud",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.3"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-ip ltm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip apm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip wom hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "kerberos",
"scope": "eq",
"trust": 0.3,
"vendor": "mit",
"version": "51.6.1"
},
{
"model": "big-iq security",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.2"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip analytics hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "communications webrtc session controller",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "7.1"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "big-iq security",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0.00"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "communications webrtc session controller",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "7.2"
},
{
"model": "big-ip link controller hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip gtm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "9.0"
},
{
"model": "big-ip psm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "3.1.1"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "3.1"
},
{
"model": "big-ip pem hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip edge gateway hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "big-ip edge gateway hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.6.0"
},
{
"model": "big-ip psm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
}
],
"sources": [
{
"db": "BID",
"id": "69168"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-122"
},
{
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.10.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.8.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.8.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.8.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.9.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.10.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.10.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.8.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.8.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.9.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.8.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.9.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.9.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tomas Kuthan",
"sources": [
{
"db": "BID",
"id": "69168"
}
],
"trust": 0.3
},
"cve": "CVE-2014-4345",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.8,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 8.5,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2014-4345",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-4345",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201408-122",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2014-4345",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2014-4345"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-122"
},
{
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of \"cpw -keepold\" commands. MIT kerberos 5 is prone to a buffer overflow vulnerability due to a out-of-bounds write memory access condition. \nAttackers can exploit this issue to execute arbitrary code within the context of the user. Failed attempts will likely cause a denial-of-service condition. \nMIT kerberos 5 1.6 through 1.12.1 are vulnerable. \n\nCVE-2014-4343\n\n An unauthenticated remote attacker with the ability to spoof packets\n appearing to be from a GSSAPI acceptor can cause a double-free\n condition in GSSAPI initiators (clients) which are using the SPNEGO\n mechanism, by returning a different underlying mechanism than was\n proposed by the initiator. \n\nCVE-2014-4344\n\n An unauthenticated or partially authenticated remote attacker can\n cause a NULL dereference and application crash during a SPNEGO\n negotiation by sending an empty token as the second or later context\n token from initiator to acceptor. \n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 1.10.1+dfsg-5+deb7u2. \n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.12.1+dfsg-7. ==========================================================================\nUbuntu Security Notice USN-2310-1\nAugust 11, 2014\n\nkrb5 vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 14.04 LTS\n- Ubuntu 12.04 LTS\n- Ubuntu 10.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Kerberos. This issue only affected Ubuntu\n12.04 LTS. This\nissue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. This issue only affected\nUbuntu 10.04 LTS and Ubuntu 12.04 LTS. \nThis issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. \n(CVE-2014-4344)\n\nTomas Kuthan and Greg Hudson discovered that the Kerberos kadmind daemon\nincorrectly handled buffers when used with the LDAP backend. (CVE-2014-4345)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 14.04 LTS:\n krb5-admin-server 1.12+dfsg-2ubuntu4.2\n krb5-kdc 1.12+dfsg-2ubuntu4.2\n krb5-kdc-ldap 1.12+dfsg-2ubuntu4.2\n krb5-otp 1.12+dfsg-2ubuntu4.2\n krb5-pkinit 1.12+dfsg-2ubuntu4.2\n krb5-user 1.12+dfsg-2ubuntu4.2\n libgssapi-krb5-2 1.12+dfsg-2ubuntu4.2\n libgssrpc4 1.12+dfsg-2ubuntu4.2\n libk5crypto3 1.12+dfsg-2ubuntu4.2\n libkadm5clnt-mit9 1.12+dfsg-2ubuntu4.2\n libkadm5srv-mit9 1.12+dfsg-2ubuntu4.2\n libkdb5-7 1.12+dfsg-2ubuntu4.2\n libkrad0 1.12+dfsg-2ubuntu4.2\n libkrb5-3 1.12+dfsg-2ubuntu4.2\n libkrb5support0 1.12+dfsg-2ubuntu4.2\n\nUbuntu 12.04 LTS:\n krb5-admin-server 1.10+dfsg~beta1-2ubuntu0.5\n krb5-kdc 1.10+dfsg~beta1-2ubuntu0.5\n krb5-kdc-ldap 1.10+dfsg~beta1-2ubuntu0.5\n krb5-pkinit 1.10+dfsg~beta1-2ubuntu0.5\n krb5-user 1.10+dfsg~beta1-2ubuntu0.5\n libgssapi-krb5-2 1.10+dfsg~beta1-2ubuntu0.5\n libgssrpc4 1.10+dfsg~beta1-2ubuntu0.5\n libk5crypto3 1.10+dfsg~beta1-2ubuntu0.5\n libkadm5clnt-mit8 1.10+dfsg~beta1-2ubuntu0.5\n libkadm5srv-mit8 1.10+dfsg~beta1-2ubuntu0.5\n libkdb5-6 1.10+dfsg~beta1-2ubuntu0.5\n libkrb5-3 1.10+dfsg~beta1-2ubuntu0.5\n libkrb5support0 1.10+dfsg~beta1-2ubuntu0.5\n\nUbuntu 10.04 LTS:\n krb5-admin-server 1.8.1+dfsg-2ubuntu0.13\n krb5-kdc 1.8.1+dfsg-2ubuntu0.13\n krb5-kdc-ldap 1.8.1+dfsg-2ubuntu0.13\n krb5-pkinit 1.8.1+dfsg-2ubuntu0.13\n krb5-user 1.8.1+dfsg-2ubuntu0.13\n libgssapi-krb5-2 1.8.1+dfsg-2ubuntu0.13\n libgssrpc4 1.8.1+dfsg-2ubuntu0.13\n libk5crypto3 1.8.1+dfsg-2ubuntu0.13\n libkadm5clnt-mit7 1.8.1+dfsg-2ubuntu0.13\n libkadm5srv-mit7 1.8.1+dfsg-2ubuntu0.13\n libkdb5-4 1.8.1+dfsg-2ubuntu0.13\n libkrb5-3 1.8.1+dfsg-2ubuntu0.13\n libkrb5support0 1.8.1+dfsg-2ubuntu0.13\n\nIn general, a standard system update will make all the necessary changes. \n _______________________________________________________________________\n\n References:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4341\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4342\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4344\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4345\n http://advisories.mageia.org/MGASA-2014-0345.html\n _______________________________________________________________________\n\n Updated Packages:\n\n Mandriva Business Server 1/X86_64:\n 3d717913ec53cd745cbaa0ea46321815 mbs1/x86_64/krb5-1.9.2-3.5.mbs1.x86_64.rpm\n e11b2338f4265d9241013211644543d9 mbs1/x86_64/krb5-pkinit-openssl-1.9.2-3.5.mbs1.x86_64.rpm\n 3dd7ce5af9b798a3be7fb22f3598e3a7 mbs1/x86_64/krb5-server-1.9.2-3.5.mbs1.x86_64.rpm\n a86c6a16fa6091672020b97d5873fc7f mbs1/x86_64/krb5-server-ldap-1.9.2-3.5.mbs1.x86_64.rpm\n c56d0f9b2f4f5b7145db65efd8d3627f mbs1/x86_64/krb5-workstation-1.9.2-3.5.mbs1.x86_64.rpm\n 67a0a6fc9192328cedd811db760089b4 mbs1/x86_64/lib64krb53-1.9.2-3.5.mbs1.x86_64.rpm\n ff121251269cab55a574bc5a06c739b0 mbs1/x86_64/lib64krb53-devel-1.9.2-3.5.mbs1.x86_64.rpm \n 0308ef62a73141b5f0915251796608c7 mbs1/SRPMS/krb5-1.9.2-3.5.mbs1.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\n of md5 checksums and GPG signatures is performed automatically for you. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nMITKRB5-SA-2014-001\n\nMIT krb5 Security Advisory 2014-001\nOriginal release: 2014-08-07\nLast update: 2014-08-07\n\nTopic: Buffer overrun in kadmind with LDAP backend\n\nCVSSv2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C\n\nCVSSv2 Base Score: 8.5\n\nAccess Vector: Network\nAccess Complexity: Medium\nAuthentication: Single\nConfidentiality Impact: Complete\nIntegrity Impact: Complete\nAvailability Impact: Complete\n\nCVSSv2 Temporal Score: 6.7\n\nExploitability: Proof-of-Concept\nRemediation Level: Official Fix\nReport Confidence: Confirmed\n\nSUMMARY\n=======\n\nIn MIT krb5, when kadmind is configured to use LDAP for the KDC\ndatabase, an authenticated remote attacker can cause it to perform an\nout-of-bounds write (buffer overflow). This is not a protocol\nvulnerability. Using LDAP for the KDC database is a non-default\nconfiguration for the KDC. \n\nIMPACT\n======\n\nHistorically, it has been possible to convert an out-of-bounds write\ninto remote code execution in some cases, though the necessary exploits\nmust be tailored to the individual application and are usually quite\ncomplicated. Depending on the allocated length of the array, an\nout-of-bounds write may also cause a segmentation fault and/or\napplication crash. \n\nAFFECTED SOFTWARE\n=================\n\n* The kadmind daemon from MIT krb5 releases 1.6 to 1.12.2, when\n configured to use the LDAP backend for the KDB, is vulnerable. \n Releases of MIT krb5 prior to 1.6 did not provide the ability to use\n LDAP for the KDB backend. \n\nFIXES\n=====\n\n* Workaround: disable or restrict access to kadmind until a patched\n version can be installed. This will prevent principal creation,\n password changes, keytab updates, and other administrative operations. \n\n* The krb5-1.12.2 and krb5-1.11.6 releases will contain a fix for this\n vulnerability. \n\ndiff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c\nindex ce851ea..df5934c 100644\n- --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c\n+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c\n@@ -456,7 +456,8 @@ krb5_encode_krbsecretkey(krb5_key_data *key_data_in, int n_key_data,\n j++;\n last = i + 1;\n\n- - currkvno = key_data[i].key_data_kvno;\n+ if (i \u003c n_key_data - 1)\n+ currkvno = key_data[i + 1].key_data_kvno;\n }\n }\n ret[num_versions] = NULL;\n\n This patch is also available at\n\n http://web.mit.edu/kerberos/advisories/2014-001-patch.txt\n\n A PGP-signed patch is available at\n\n http://web.mit.edu/kerberos/advisories/2014-001-patch.txt.asc\n\nREFERENCES\n==========\n\nThis announcement is posted at:\n\n http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2014-001.txt\n\nThis announcement and related security advisories may be found on the\nMIT Kerberos security advisory page at:\n\n http://web.mit.edu/kerberos/advisories/index.html\n\nThe main MIT Kerberos web page is at:\n\n http://web.mit.edu/kerberos/index.html\n\nCVSSv2:\n\n http://www.first.org/cvss/cvss-guide.html\n http://nvd.nist.gov/cvss.cfm?calculator\u0026adv\u0026version=2\n\nCVE: CVE-2014-4345\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4345\n\nACKNOWLEDGMENTS\n===============\n\nThis off-by-one error was reported by Tomas Kuthan as github pull\nrequest #181 and recognized as a vulnerability by Greg Hudson. When sending sensitive information,\nplease PGP-encrypt it using the following key:\n\npub 2048R/C436A9C6 2014-01-07 [expires: 2015-02-01]\n Key fingerprint = 1849 02FF 0CA8 A385 F28D 2E7E 2AF0 C1EA C436 A9C6\nuid MIT Kerberos Team Security Contact \u003ckrbcore-security@mit.edu\u003e\n\nDETAILS\n=======\n\nThe \u0027cpw -keepold\u0027 functionality allows for the existing keys to be\nretained at password-change (or keytab-change) time, instead of being\ndiscarded as usual. An array must be allocated to store all the old\nkeys, as well as the new keys and a NULL terminator. In normal\noperation, all the keys for a single kvno will share an array slot. An\noff-by-one error while copying key information to the new array results\nin keys sharing a common kvno being written to different array buckets,\nwith the first key of a kvno betting a single bucket, and the remaining\nkeys getting the next bucket. After sufficient iterations, the extra\nwrites extend past the end of the (NULL-terminated) array. The NULL\nterminator is always written after the end of the loop, so no\nout-of-bounds data is read, it is only written. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 app-crypt/mit-krb5 \u003c 1.13 \u003e= 1.13 \n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in MIT Kerberos 5. Please\nreview the CVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll MIT Kerberos 5 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=app-crypt/mit-krb5-1.13\"\n\nReferences\n==========\n\n[ 1 ] CVE-2014-4341\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4341\n[ 2 ] CVE-2014-4343\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4343\n[ 3 ] CVE-2014-4345\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4345\n[ 4 ] CVE-2014-5351\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5351\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201412-53.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2014 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: krb5 security, bug fix and enhancement update\nAdvisory ID: RHSA-2015:0439-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2015-0439.html\nIssue date: 2015-03-05\nCVE Names: CVE-2014-4341 CVE-2014-4342 CVE-2014-4343 \n CVE-2014-4344 CVE-2014-4345 CVE-2014-5352 \n CVE-2014-5353 CVE-2014-9421 CVE-2014-9422 \n CVE-2014-9423 \n=====================================================================\n\n1. Summary:\n\nUpdated krb5 packages that fix multiple security issues, several bugs, and\nadd various enhancements are now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section. \n\nKerberos is a networked authentication system which allows clients and\nservers to authenticate to each other with the help of a trusted third\nparty, the Kerberos KDC. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\n\n3. Description:\n\nA NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO\nacceptor for continuation tokens. A remote, unauthenticated attacker could\nuse this flaw to crash a GSSAPI-enabled server application. (CVE-2014-4344)\n\nA buffer overflow was found in the KADM5 administration server (kadmind)\nwhen it was used with an LDAP back end for the KDC database. (CVE-2014-4345)\n\nA use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5\nlibrary processed valid context deletion tokens. An attacker able to make\nan application using the GSS-API library (libgssapi) call the\ngss_process_context_token() function could use this flaw to crash that\napplication. (CVE-2014-5352)\n\nIf kadmind were used with an LDAP back end for the KDC database, a remote,\nauthenticated attacker with the permissions to set the password policy\ncould crash kadmind by attempting to use a named ticket policy object as a\npassword policy for a principal. (CVE-2014-5353)\n\nA double-free flaw was found in the way MIT Kerberos handled invalid\nExternal Data Representation (XDR) data. An authenticated user could use\nthis flaw to crash the MIT Kerberos administration server (kadmind), or\nother applications using Kerberos libraries, using specially crafted XDR\npackets. (CVE-2014-9421)\n\nIt was found that the MIT Kerberos administration server (kadmind)\nincorrectly accepted certain authentication requests for two-component\nserver principal names. A remote attacker able to acquire a key with a\nparticularly named principal (such as \"kad/x\") could use this flaw to\nimpersonate any user to kadmind, and perform administrative actions as that\nuser. (CVE-2014-9422)\n\nAn information disclosure flaw was found in the way MIT Kerberos RPCSEC_GSS\nimplementation (libgssrpc) handled certain requests. An attacker could send\na specially crafted request to an application using libgssrpc to disclose a\nlimited portion of uninitialized memory used by that application. \n(CVE-2014-9423)\n\nTwo buffer over-read flaws were found in the way MIT Kerberos handled\ncertain requests. A remote, unauthenticated attacker able to inject packets\ninto a client or server application\u0027s GSSAPI session could use either of\nthese flaws to crash the application. An\nattacker able to spoof packets to appear as though they are from an GSSAPI\nacceptor could use this flaw to crash a client application that uses MIT\nKerberos. (CVE-2014-4343)\n\nRed Hat would like to thank the MIT Kerberos project for reporting the\nCVE-2014-5352, CVE-2014-9421, CVE-2014-9422, and CVE-2014-9423 issues. MIT\nKerberos project acknowledges Nico Williams for helping with the analysis\nof CVE-2014-5352. \n\nThe krb5 packages have been upgraded to upstream version 1.12, which\nprovides a number of bug fixes and enhancements, including:\n\n* Added plug-in interfaces for principal-to-username mapping and verifying\nauthorization to user accounts. \n\n* When communicating with a KDC over a connected TCP or HTTPS socket, the\nclient gives the KDC more time to reply before it transmits the request to\nanother server. (BZ#1049709, BZ#1127995)\n\nThis update also fixes multiple bugs, for example:\n\n* The Kerberos client library did not recognize certain exit statuses that\nthe resolver libraries could return when looking up the addresses of\nservers configured in the /etc/krb5.conf file or locating Kerberos servers\nusing DNS service location. The library could treat non-fatal return codes\nas fatal errors. Now, the library interprets the specific return codes\ncorrectly. (BZ#1084068, BZ#1109102)\n\nIn addition, this update adds various enhancements. Among others:\n\n* Added support for contacting KDCs and kpasswd servers through HTTPS\nproxies implementing the Kerberos KDC Proxy (KKDCP) protocol. (BZ#1109919)\n\n4. Solution:\n\nAll krb5 users are advised to upgrade to these updated packages, which\ncorrect these issues and add these enhancements. \n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1084068 - ipv6 address handling in krb5.conf\n1102837 - Please backport improved GSSAPI mech configuration\n1109102 - Kerberos does not handle incorrect Active Directory DNS SRV entries correctly\n1109919 - Backport https support into libkrb5\n1116180 - CVE-2014-4341 krb5: denial of service flaws when handling padding length longer than the plaintext\n1118347 - ksu non-functional, gets invalid argument copying cred cache\n1120581 - CVE-2014-4342 krb5: denial of service flaws when handling RFC 1964 tokens\n1121789 - CVE-2014-4343: use-after-free crash in SPNEGO\n1121876 - CVE-2014-4343 krb5: double-free flaw in SPNEGO initiators\n1121877 - CVE-2014-4344 krb5: NULL pointer dereference flaw in SPNEGO acceptor for continuation tokens\n1127995 - aggressive kinit timeout causes AS_REQ resent and subsequent OTP auth failure\n1128157 - CVE-2014-4345 krb5: buffer overrun in kadmind with LDAP backend (MITKRB5-SA-2014-001)\n1166012 - libkadmclnt SONAME change (8 to 9) in krb5 1.12 update\n1174543 - CVE-2014-5353 krb5: NULL pointer dereference when using a ticket policy name as a password policy name\n1179856 - CVE-2014-5352 krb5: gss_process_context_token() incorrectly frees context (MITKRB5-SA-2015-001)\n1179857 - CVE-2014-9421 krb5: kadmind doubly frees partial deserialization results (MITKRB5-SA-2015-001)\n1179861 - CVE-2014-9422 krb5: kadmind incorrectly validates server principal name (MITKRB5-SA-2015-001)\n1179863 - CVE-2014-9423 krb5: libgssrpc server applications leak uninitialized bytes (MITKRB5-SA-2015-001)\n1184629 - kinit loops on principals on unknown error\n\n6. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nkrb5-1.12.2-14.el7.src.rpm\n\nx86_64:\nkrb5-debuginfo-1.12.2-14.el7.i686.rpm\nkrb5-debuginfo-1.12.2-14.el7.x86_64.rpm\nkrb5-libs-1.12.2-14.el7.i686.rpm\nkrb5-libs-1.12.2-14.el7.x86_64.rpm\nkrb5-pkinit-1.12.2-14.el7.x86_64.rpm\nkrb5-workstation-1.12.2-14.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nkrb5-debuginfo-1.12.2-14.el7.i686.rpm\nkrb5-debuginfo-1.12.2-14.el7.x86_64.rpm\nkrb5-devel-1.12.2-14.el7.i686.rpm\nkrb5-devel-1.12.2-14.el7.x86_64.rpm\nkrb5-server-1.12.2-14.el7.x86_64.rpm\nkrb5-server-ldap-1.12.2-14.el7.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nkrb5-1.12.2-14.el7.src.rpm\n\nx86_64:\nkrb5-debuginfo-1.12.2-14.el7.i686.rpm\nkrb5-debuginfo-1.12.2-14.el7.x86_64.rpm\nkrb5-libs-1.12.2-14.el7.i686.rpm\nkrb5-libs-1.12.2-14.el7.x86_64.rpm\nkrb5-pkinit-1.12.2-14.el7.x86_64.rpm\nkrb5-workstation-1.12.2-14.el7.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\nkrb5-debuginfo-1.12.2-14.el7.i686.rpm\nkrb5-debuginfo-1.12.2-14.el7.x86_64.rpm\nkrb5-devel-1.12.2-14.el7.i686.rpm\nkrb5-devel-1.12.2-14.el7.x86_64.rpm\nkrb5-server-1.12.2-14.el7.x86_64.rpm\nkrb5-server-ldap-1.12.2-14.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nkrb5-1.12.2-14.el7.src.rpm\n\nppc64:\nkrb5-debuginfo-1.12.2-14.el7.ppc.rpm\nkrb5-debuginfo-1.12.2-14.el7.ppc64.rpm\nkrb5-devel-1.12.2-14.el7.ppc.rpm\nkrb5-devel-1.12.2-14.el7.ppc64.rpm\nkrb5-libs-1.12.2-14.el7.ppc.rpm\nkrb5-libs-1.12.2-14.el7.ppc64.rpm\nkrb5-pkinit-1.12.2-14.el7.ppc64.rpm\nkrb5-server-1.12.2-14.el7.ppc64.rpm\nkrb5-server-ldap-1.12.2-14.el7.ppc64.rpm\nkrb5-workstation-1.12.2-14.el7.ppc64.rpm\n\ns390x:\nkrb5-debuginfo-1.12.2-14.el7.s390.rpm\nkrb5-debuginfo-1.12.2-14.el7.s390x.rpm\nkrb5-devel-1.12.2-14.el7.s390.rpm\nkrb5-devel-1.12.2-14.el7.s390x.rpm\nkrb5-libs-1.12.2-14.el7.s390.rpm\nkrb5-libs-1.12.2-14.el7.s390x.rpm\nkrb5-pkinit-1.12.2-14.el7.s390x.rpm\nkrb5-server-1.12.2-14.el7.s390x.rpm\nkrb5-server-ldap-1.12.2-14.el7.s390x.rpm\nkrb5-workstation-1.12.2-14.el7.s390x.rpm\n\nx86_64:\nkrb5-debuginfo-1.12.2-14.el7.i686.rpm\nkrb5-debuginfo-1.12.2-14.el7.x86_64.rpm\nkrb5-devel-1.12.2-14.el7.i686.rpm\nkrb5-devel-1.12.2-14.el7.x86_64.rpm\nkrb5-libs-1.12.2-14.el7.i686.rpm\nkrb5-libs-1.12.2-14.el7.x86_64.rpm\nkrb5-pkinit-1.12.2-14.el7.x86_64.rpm\nkrb5-server-1.12.2-14.el7.x86_64.rpm\nkrb5-server-ldap-1.12.2-14.el7.x86_64.rpm\nkrb5-workstation-1.12.2-14.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nkrb5-1.12.2-14.el7.src.rpm\n\nx86_64:\nkrb5-debuginfo-1.12.2-14.el7.i686.rpm\nkrb5-debuginfo-1.12.2-14.el7.x86_64.rpm\nkrb5-devel-1.12.2-14.el7.i686.rpm\nkrb5-devel-1.12.2-14.el7.x86_64.rpm\nkrb5-libs-1.12.2-14.el7.i686.rpm\nkrb5-libs-1.12.2-14.el7.x86_64.rpm\nkrb5-pkinit-1.12.2-14.el7.x86_64.rpm\nkrb5-server-1.12.2-14.el7.x86_64.rpm\nkrb5-server-ldap-1.12.2-14.el7.x86_64.rpm\nkrb5-workstation-1.12.2-14.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2014-4341\nhttps://access.redhat.com/security/cve/CVE-2014-4342\nhttps://access.redhat.com/security/cve/CVE-2014-4343\nhttps://access.redhat.com/security/cve/CVE-2014-4344\nhttps://access.redhat.com/security/cve/CVE-2014-4345\nhttps://access.redhat.com/security/cve/CVE-2014-5352\nhttps://access.redhat.com/security/cve/CVE-2014-5353\nhttps://access.redhat.com/security/cve/CVE-2014-9421\nhttps://access.redhat.com/security/cve/CVE-2014-9422\nhttps://access.redhat.com/security/cve/CVE-2014-9423\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2015 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFU+GoxXlSAg2UNWIIRAtkZAJ9PYyHLsR1t+YWgqw4jb4XTtX8iuACgkxfi\ngZD8EL2lSaLXnIQxca8zLTg=\n=aK0y\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. 6) - i386, x86_64\n\n3. \n\nIt was found that if a KDC served multiple realms, certain requests could\ncause the setup_server_realm() function to dereference a NULL pointer. (CVE-2014-4343)\n\nThese updated krb5 packages also include several bug fixes. Space precludes\ndocumenting all of these changes in this advisory. Users are directed to\nthe Red Hat Enterprise Linux 6.6 Technical Notes, linked to in the\nReferences section, for information on the most significant of these\nchanges",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-4345"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"db": "BID",
"id": "69168"
},
{
"db": "VULMON",
"id": "CVE-2014-4345"
},
{
"db": "PACKETSTORM",
"id": "127813"
},
{
"db": "PACKETSTORM",
"id": "127825"
},
{
"db": "PACKETSTORM",
"id": "128077"
},
{
"db": "PACKETSTORM",
"id": "127832"
},
{
"db": "PACKETSTORM",
"id": "129774"
},
{
"db": "PACKETSTORM",
"id": "130669"
},
{
"db": "PACKETSTORM",
"id": "128660"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-4345",
"trust": 3.5
},
{
"db": "BID",
"id": "69168",
"trust": 2.0
},
{
"db": "JUNIPER",
"id": "JSA10705",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1030705",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "60535",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "61353",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "61314",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "59102",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "60776",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "59993",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "59415",
"trust": 1.7
},
{
"db": "OSVDB",
"id": "109908",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003820",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201408-122",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2014-4345",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127813",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127825",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "128077",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127832",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "129774",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "130669",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "128660",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2014-4345"
},
{
"db": "BID",
"id": "69168"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"db": "PACKETSTORM",
"id": "127813"
},
{
"db": "PACKETSTORM",
"id": "127825"
},
{
"db": "PACKETSTORM",
"id": "128077"
},
{
"db": "PACKETSTORM",
"id": "127832"
},
{
"db": "PACKETSTORM",
"id": "129774"
},
{
"db": "PACKETSTORM",
"id": "130669"
},
{
"db": "PACKETSTORM",
"id": "128660"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-122"
},
{
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"id": "VAR-201408-0300",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.4440100783333334
},
"last_update_date": "2024-07-23T19:28:23.568000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fix LDAP key data segmentation [CVE-2014-4345]",
"trust": 0.8,
"url": "https://github.com/krb5/krb5/commit/dc7ed55c689d57de7f7408b34631bf06fec9dab1"
},
{
"title": "MITKRB5-SA-2014-001",
"trust": 0.8,
"url": "http://web.mit.edu/kerberos/advisories/mitkrb5-sa-2014-001.txt"
},
{
"title": "RHSA-2015:0439",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2015-0439.html"
},
{
"title": "Ticket #7980 LDAP key data segmentation buffer overflow [CVE-2014-4345]",
"trust": 0.8,
"url": "http://krbdev.mit.edu/rt/ticket/display.html?id=7980"
},
{
"title": "CVE-2014-4345 Numeric Errors vulnerability in Kerberos",
"trust": 0.8,
"url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_4345_numeric_errors"
},
{
"title": "Debian CVElist Bug Report Logs: CVE-2014-4344 in krb5: NULL dereference in GSSAPI servers",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=35d4f3ce5652ab755f81ed48de881600"
},
{
"title": "Debian CVElist Bug Report Logs: CVE-2014-4343 in krb5: double-free in SPNEGO initiators",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=9c2c9693f1995e06458de00ef1a741ea"
},
{
"title": "Debian CVElist Bug Report Logs: CVE-2014-4345 in krb5-kdc-ldap: buffer overrun in kadmind",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=5b462e2e6415f47bd0fd28d7421f6993"
},
{
"title": "Debian CVElist Bug Report Logs: CVE-2014-4341 in krb5: insufficient validation processing rfc 1964 tokens",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=4d39c93e60e14a46f4d47ceeb92df9f3"
},
{
"title": "Debian CVElist Bug Report Logs: CVE-2014-4342 in krb5: insufficient validation processing rfc 1964 tokens",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=289247c77758756a143eb9a839abfd1d"
},
{
"title": "Debian Security Advisories: DSA-3000-1 krb5 -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=4185a1f803abcb8297ba9b981d24413f"
},
{
"title": "Ubuntu Security Notice: krb5 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-2310-1"
},
{
"title": "Amazon Linux AMI: ALAS-2014-443",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2014-443"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - October 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=523d3f220a64ff01dd95e064bd37566a"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2014-4345"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-189",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://web.mit.edu/kerberos/advisories/mitkrb5-sa-2014-001.txt"
},
{
"trust": 2.0,
"url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_4345_numeric_errors"
},
{
"trust": 2.0,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/69168"
},
{
"trust": 1.8,
"url": "http://security.gentoo.org/glsa/glsa-201412-53.xml"
},
{
"trust": 1.8,
"url": "http://rhn.redhat.com/errata/rhsa-2015-0439.html"
},
{
"trust": 1.8,
"url": "http://advisories.mageia.org/mgasa-2014-0345.html"
},
{
"trust": 1.7,
"url": "https://github.com/krb5/krb5/commit/dc7ed55c689d57de7f7408b34631bf06fec9dab1"
},
{
"trust": 1.7,
"url": "http://krbdev.mit.edu/rt/ticket/display.html?id=7980"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id/1030705"
},
{
"trust": 1.7,
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00009.html"
},
{
"trust": 1.7,
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00030.html"
},
{
"trust": 1.7,
"url": "http://rhn.redhat.com/errata/rhsa-2014-1255.html"
},
{
"trust": 1.7,
"url": "http://www.debian.org/security/2014/dsa-3000"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/59415"
},
{
"trust": 1.7,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10705"
},
{
"trust": 1.7,
"url": "https://github.com/krb5/krb5/pull/181"
},
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1128157"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/109908"
},
{
"trust": 1.7,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2014:165"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/61353"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/61314"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/60776"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/60535"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/59993"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/59102"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-august/137056.html"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-august/136640.html"
},
{
"trust": 1.7,
"url": "http://linux.oracle.com/errata/elsa-2014-1255.html"
},
{
"trust": 1.7,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95212"
},
{
"trust": 1.0,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4345"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4345"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4345"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4341"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4343"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4344"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4342"
},
{
"trust": 0.3,
"url": "http://web.mit.edu/kerberos/"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/101004185"
},
{
"trust": 0.3,
"url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5096510"
},
{
"trust": 0.3,
"url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15566.html?ref=rss"
},
{
"trust": 0.2,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1418"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-6800"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.2,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.2,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/189.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=35226"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/2310-1/"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/krb5/1.8.1+dfsg-2ubuntu0.13"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/krb5/1.12+dfsg-2ubuntu4.2"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1416"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/krb5/1.10+dfsg~beta1-2ubuntu0.5"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-1016"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1415"
},
{
"trust": 0.1,
"url": "http://www.ubuntu.com/usn/usn-2310-1"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4344"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/en/support/security/"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/en/support/security/advisories/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4341"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4342"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/cvss.cfm?calculator\u0026adv\u0026version=2"
},
{
"trust": 0.1,
"url": "http://web.mit.edu/kerberos/advisories/index.html"
},
{
"trust": 0.1,
"url": "http://www.first.org/cvss/cvss-guide.html"
},
{
"trust": 0.1,
"url": "http://web.mit.edu/kerberos/advisories/2014-001-patch.txt.asc"
},
{
"trust": 0.1,
"url": "http://web.mit.edu/kerberos/index.html"
},
{
"trust": 0.1,
"url": "http://web.mit.edu/kerberos/advisories/2014-001-patch.txt"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4343"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-5351"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4345"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4341"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-5351"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-4342"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-4343"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-9421"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-5353"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-9423"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-4341"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-5353"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-9422"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-9421"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-4345"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-9423"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-5352"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-5352"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-9422"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-4344"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2013-6800.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-4345.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-4344.html"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2014-1389.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-4343.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2013-1418.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/6.6_technical_notes/krb5.html#rhsa-2014-1389"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-4342.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-4341.html"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2014-4345"
},
{
"db": "BID",
"id": "69168"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"db": "PACKETSTORM",
"id": "127813"
},
{
"db": "PACKETSTORM",
"id": "127825"
},
{
"db": "PACKETSTORM",
"id": "128077"
},
{
"db": "PACKETSTORM",
"id": "127832"
},
{
"db": "PACKETSTORM",
"id": "129774"
},
{
"db": "PACKETSTORM",
"id": "130669"
},
{
"db": "PACKETSTORM",
"id": "128660"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-122"
},
{
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2014-4345"
},
{
"db": "BID",
"id": "69168"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"db": "PACKETSTORM",
"id": "127813"
},
{
"db": "PACKETSTORM",
"id": "127825"
},
{
"db": "PACKETSTORM",
"id": "128077"
},
{
"db": "PACKETSTORM",
"id": "127832"
},
{
"db": "PACKETSTORM",
"id": "129774"
},
{
"db": "PACKETSTORM",
"id": "130669"
},
{
"db": "PACKETSTORM",
"id": "128660"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-122"
},
{
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-08-14T00:00:00",
"db": "VULMON",
"id": "CVE-2014-4345"
},
{
"date": "2014-08-09T00:00:00",
"db": "BID",
"id": "69168"
},
{
"date": "2014-08-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"date": "2014-08-11T13:33:00",
"db": "PACKETSTORM",
"id": "127813"
},
{
"date": "2014-08-11T18:24:00",
"db": "PACKETSTORM",
"id": "127825"
},
{
"date": "2014-09-02T20:17:38",
"db": "PACKETSTORM",
"id": "128077"
},
{
"date": "2014-08-09T14:04:44",
"db": "PACKETSTORM",
"id": "127832"
},
{
"date": "2014-12-31T12:12:00",
"db": "PACKETSTORM",
"id": "129774"
},
{
"date": "2015-03-05T21:51:51",
"db": "PACKETSTORM",
"id": "130669"
},
{
"date": "2014-10-14T23:04:48",
"db": "PACKETSTORM",
"id": "128660"
},
{
"date": "2014-08-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201408-122"
},
{
"date": "2014-08-14T05:01:50.817000",
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-01-21T00:00:00",
"db": "VULMON",
"id": "CVE-2014-4345"
},
{
"date": "2017-10-19T03:03:00",
"db": "BID",
"id": "69168"
},
{
"date": "2015-06-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003820"
},
{
"date": "2020-01-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201408-122"
},
{
"date": "2020-01-21T15:46:47.197000",
"db": "NVD",
"id": "CVE-2014-4345"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "127825"
},
{
"db": "PACKETSTORM",
"id": "128077"
},
{
"db": "PACKETSTORM",
"id": "127832"
},
{
"db": "PACKETSTORM",
"id": "130669"
},
{
"db": "PACKETSTORM",
"id": "128660"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-122"
}
],
"trust": 1.1
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "MIT Kerberos 5 of kadmind of LDAP KDB Module plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c Service disruption in (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003820"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "digital error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201408-122"
}
],
"trust": 0.6
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.