CVE-2014-5355: Null Pointer Dereference
First published: Fri Feb 20 2015(Updated: )
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MIT Kerberos 5 Application | =1.1 | |
| MIT Kerberos 5 Application | =1.2 | |
| MIT Kerberos 5 Application | =1.2.1 | |
| MIT Kerberos 5 Application | =1.2.2 | |
| MIT Kerberos 5 Application | =1.2.3 | |
| MIT Kerberos 5 Application | =1.2.4 | |
| MIT Kerberos 5 Application | =1.2.5 | |
| MIT Kerberos 5 Application | =1.2.6 | |
| MIT Kerberos 5 Application | =1.2.7 | |
| MIT Kerberos 5 Application | =1.2.8 | |
| MIT Kerberos 5 Application | =1.3 | |
| MIT Kerberos 5 Application | =1.3-alpha1 | |
| MIT Kerberos 5 Application | =1.3.1 | |
| MIT Kerberos 5 Application | =1.3.2 | |
| MIT Kerberos 5 Application | =1.3.3 | |
| MIT Kerberos 5 Application | =1.3.4 | |
| MIT Kerberos 5 Application | =1.3.5 | |
| MIT Kerberos 5 Application | =1.3.6 | |
| MIT Kerberos 5 Application | =1.4 | |
| MIT Kerberos 5 Application | =1.4.1 | |
| MIT Kerberos 5 Application | =1.4.2 | |
| MIT Kerberos 5 Application | =1.4.3 | |
| MIT Kerberos 5 Application | =1.4.4 | |
| MIT Kerberos 5 Application | =1.5 | |
| MIT Kerberos 5 Application | =1.5.1 | |
| MIT Kerberos 5 Application | =1.5.2 | |
| MIT Kerberos 5 Application | =1.5.3 | |
| MIT Kerberos 5 Application | =1.6 | |
| MIT Kerberos 5 Application | =1.6.1 | |
| MIT Kerberos 5 Application | =1.6.2 | |
| MIT Kerberos 5 Application | =1.7 | |
| MIT Kerberos 5 Application | =1.7.1 | |
| MIT Kerberos 5 Application | =1.8 | |
| MIT Kerberos 5 Application | =1.8.1 | |
| MIT Kerberos 5 Application | =1.8.2 | |
| MIT Kerberos 5 Application | =1.8.3 | |
| MIT Kerberos 5 Application | =1.8.4 | |
| MIT Kerberos 5 Application | =1.8.5 | |
| MIT Kerberos 5 Application | =1.8.6 | |
| MIT Kerberos 5 Application | =1.9 | |
| MIT Kerberos 5 Application | =1.9.1 | |
| MIT Kerberos 5 Application | =1.9.2 | |
| MIT Kerberos 5 Application | =1.9.3 | |
| MIT Kerberos 5 Application | =1.9.4 | |
| MIT Kerberos 5 Application | =1.10 | |
| MIT Kerberos 5 Application | =1.10.1 | |
| MIT Kerberos 5 Application | =1.10.2 | |
| MIT Kerberos 5 Application | =1.10.3 | |
| MIT Kerberos 5 Application | =1.10.4 | |
| MIT Kerberos 5 Application | =1.11 | |
| MIT Kerberos 5 Application | =1.11.1 | |
| MIT Kerberos 5 Application | =1.11.2 | |
| MIT Kerberos 5 Application | =1.11.3 | |
| MIT Kerberos 5 Application | =1.11.4 | |
| MIT Kerberos 5 Application | =1.11.5 | |
| MIT Kerberos 5 Application | =1.12 | |
| MIT Kerberos 5 Application | =1.12.1 | |
| MIT Kerberos 5 Application | =1.12.2 | |
| MIT Kerberos 5 Application | =1.13 | |
| MIT Kerberos 5 Application | =1.13.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html
- http://rhn.redhat.com/errata/RHSA-2015-0794.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:069
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/74042
- http://www.ubuntu.com/usn/USN-2810-1
- https://github.com/krb5/krb5/commit/102bb6ebf20f9174130c85c3b052ae104e5073ec
- https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html
Frequently Asked Questions
What is the severity of CVE-2014-5355?
CVE-2014-5355 has a severity rating that can lead to denial of service due to NULL pointer dereference.
Which versions of MIT Kerberos 5 are affected by CVE-2014-5355?
CVE-2014-5355 affects MIT Kerberos 5 versions 1.1 through 1.13.1.
How do I fix CVE-2014-5355?
The fix for CVE-2014-5355 involves updating MIT Kerberos 5 to version 1.13.2 or later.
What type of attack can be executed using CVE-2014-5355?
CVE-2014-5355 allows remote attackers to cause a denial of service via a zero-byte version string.
Is there a known exploit for CVE-2014-5355?
Yes, CVE-2014-5355 has been documented as a vulnerability that can be exploited for denial of service attacks.
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- vendor/mit
- canonical/mit kerberos 5 application
- version/mit kerberos 5 application/1.1
- version/mit kerberos 5 application/1.2
- version/mit kerberos 5 application/1.2.1
- version/mit kerberos 5 application/1.2.2
- version/mit kerberos 5 application/1.2.3
- version/mit kerberos 5 application/1.2.4
- version/mit kerberos 5 application/1.2.5
- version/mit kerberos 5 application/1.2.6
- version/mit kerberos 5 application/1.2.7
- version/mit kerberos 5 application/1.2.8
- version/mit kerberos 5 application/1.3
- version/mit kerberos 5 application/1.3-alpha1
- version/mit kerberos 5 application/1.3.1
- version/mit kerberos 5 application/1.3.2
- version/mit kerberos 5 application/1.3.3
- version/mit kerberos 5 application/1.3.4
- version/mit kerberos 5 application/1.3.5
- version/mit kerberos 5 application/1.3.6
- version/mit kerberos 5 application/1.4
- version/mit kerberos 5 application/1.4.1
- version/mit kerberos 5 application/1.4.2
- version/mit kerberos 5 application/1.4.3
- version/mit kerberos 5 application/1.4.4
- version/mit kerberos 5 application/1.5
- version/mit kerberos 5 application/1.5.1
- version/mit kerberos 5 application/1.5.2
- version/mit kerberos 5 application/1.5.3
- version/mit kerberos 5 application/1.6
- version/mit kerberos 5 application/1.6.1
- version/mit kerberos 5 application/1.6.2
- version/mit kerberos 5 application/1.7
- version/mit kerberos 5 application/1.7.1
- version/mit kerberos 5 application/1.8
- version/mit kerberos 5 application/1.8.1
- version/mit kerberos 5 application/1.8.2
- version/mit kerberos 5 application/1.8.3
- version/mit kerberos 5 application/1.8.4
- version/mit kerberos 5 application/1.8.5
- version/mit kerberos 5 application/1.8.6
- version/mit kerberos 5 application/1.9
- version/mit kerberos 5 application/1.9.1
- version/mit kerberos 5 application/1.9.2
- version/mit kerberos 5 application/1.9.3
- version/mit kerberos 5 application/1.9.4
- version/mit kerberos 5 application/1.10
- version/mit kerberos 5 application/1.10.1
- version/mit kerberos 5 application/1.10.2
- version/mit kerberos 5 application/1.10.3
- version/mit kerberos 5 application/1.10.4
- version/mit kerberos 5 application/1.11
- version/mit kerberos 5 application/1.11.1
- version/mit kerberos 5 application/1.11.2
- version/mit kerberos 5 application/1.11.3
- version/mit kerberos 5 application/1.11.4
- version/mit kerberos 5 application/1.11.5
- version/mit kerberos 5 application/1.12
- version/mit kerberos 5 application/1.12.1
- version/mit kerberos 5 application/1.12.2
- version/mit kerberos 5 application/1.13
- version/mit kerberos 5 application/1.13.1