Summary
Robert Morris discovered that Kerberos did not properly handle memory
access when processing RPC data through kadmind, which could lead to the
freeing of uninitialized memory. An authenticated remote attacker could
possibly use this issue to cause kadmind to crash, resulting in a denial
of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | krb5 | 1.12+dfsg-2ubuntu5.4+esm4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | krb5 | 1.13.2+dfsg-5ubuntu2.2+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | krb5 | 1.16-2ubuntu0.4+esm1 |
Vulnerabilities 1
-
Unscored —
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized poi…
References
-
report
https://ubuntu.com/security/CVE-2023-36054