CVE-2014-4344: Null Pointer Dereference
A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. An unauthenticated attacker could use this flaw to crash the server acceptor.
It is reported that this issue affects version 1.5 and later.
Upstream commit and further details:
https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b
Other sources
The accctxcont function in the SPNEGO acceptor in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4344?
CVE-2014-4344 has a medium severity rating, as it allows an unauthenticated attacker to crash the server acceptor.
How do I fix CVE-2014-4344?
To fix CVE-2014-4344, you should upgrade to the patched version of MIT Kerberos 5 or apply the relevant security patches provided by your operating system vendor.
Which versions of MIT Kerberos are affected by CVE-2014-4344?
CVE-2014-4344 affects all versions of MIT Kerberos 5 starting from 1.5 and later.
What impact does CVE-2014-4344 have on a server?
The impact of CVE-2014-4344 is that an attacker can exploit the NULL pointer dereference flaw to crash the server acceptor, leading to a denial of service.
What systems are impacted by CVE-2014-4344?
CVE-2014-4344 impacts Debian GNU/Linux 7.0 and several versions of Red Hat Enterprise Linux, including server, desktop, HPC node, and workstation.