Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Kerberos_5
(Mit)Repositories | https://github.com/krb5/krb5 |
#Vulnerabilities | 134 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2005-07-18 | CVE-2005-1689 | Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions. | Mac_os_x, Mac_os_x_server, Debian_linux, Kerberos_5 | 9.8 | ||
2010-04-07 | CVE-2010-0629 | Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number. | Ubuntu_linux, Fedora, Kerberos_5, Opensuse, Linux_enterprise | 6.5 | ||
2000-06-14 | CVE-2000-0514 | GSSFTP FTP daemon in Kerberos 5 1.1.x does not properly restrict access to some FTP commands, which allows remote attackers to cause a denial of service, and local users to gain root privileges. | Kerberos_5 | N/A | ||
2005-02-09 | CVE-2004-0971 | The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files. | Kerberos_5 | N/A | ||
2016-08-01 | CVE-2016-3120 | The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request. | Kerberos_5 | 6.5 | ||
2017-08-09 | CVE-2017-11368 | In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. | Fedora, Kerberos, Kerberos_5 | 6.5 | ||
2017-09-13 | CVE-2017-11462 | Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error. | Fedora, Kerberos_5 | 9.8 | ||
2018-07-26 | CVE-2017-7562 | An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances. | Kerberos_5, Enterprise_linux, Enterprise_linux_desktop, Enterprise_linux_server, Enterprise_linux_workstation | 6.5 | ||
2019-09-26 | CVE-2019-14844 | A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC. | Fedora, Kerberos_5 | 7.5 | ||
1996-02-21 | CVE-1999-0143 | Kerberos 4 key servers allow a user to masquerade as another by breaking and generating session keys. | Kerberos, Kerberos_5, Multinet, Sunos | N/A |