CVE-2014-4345: Buffer Overflow
Off-by-one error in the krb5encodekrbsecretkey function in plugins/kdb/ldap/libkdbldap/ldapprincipal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of "cpw -keepold" commands.
Other sources
Upstream released advisory [1] which fixes out-of-bounds write (buffer overflow) Summary from the advisory: ... In MIT krb5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause it to perform an out-of-bounds write (buffer overflow). This is not a protocol vulnerability. Using LDAP for the KDC database is a non-default configuration for the KDC. ...
Further technical details and patches are available on the advisory page as well.
External References:
http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2014-001.txt
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4345?
CVE-2014-4345 has been rated as a medium severity vulnerability that can lead to denial of service.
How do I fix CVE-2014-4345?
To remediate CVE-2014-4345, update to MIT Kerberos 5 version 1.11.6 or later, or 1.12.2 or later.
Which versions of MIT Kerberos 5 are affected by CVE-2014-4345?
CVE-2014-4345 affects MIT Kerberos 5 versions from 1.6.x up to 1.11.x before 1.11.6 and 1.12.x before 1.12.2.
What type of attack does CVE-2014-4345 enable?
CVE-2014-4345 allows remote authenticated users to cause a denial of service.
Is CVE-2014-4345 related to buffer overflow?
Yes, CVE-2014-4345 is associated with an off-by-one error that can result in a buffer overflow.