CVE-2014-5352: Use After Free
The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5352?
CVE-2014-5352 has been classified as a medium severity vulnerability due to its potential to allow remote authenticated users to affect system integrity.
How do I fix CVE-2014-5352?
To fix CVE-2014-5352, upgrade to MIT Kerberos 5 version 1.13.1 or later, which contains the necessary patches.
Which versions of MIT Kerberos 5 are affected by CVE-2014-5352?
CVE-2014-5352 affects MIT Kerberos 5 versions from 1.11.0 to 1.13.0, excluding 1.13.1 and later.
What impact does CVE-2014-5352 have on security contexts?
CVE-2014-5352 impacts the maintenance of security-context handles, potentially compromising security and authentication processes.
Can I mitigate CVE-2014-5352 without updating?
Mitigating CVE-2014-5352 without updating is difficult; the best practice is to apply the available updates to ensure security.