CVE-2014-9423: Infoleak
The svcauthgssacceptseccontext function in lib/rpc/svcauthgss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9423?
CVE-2014-9423 has a medium severity rating as it allows remote attackers to obtain sensitive information.
How do I fix CVE-2014-9423?
To fix CVE-2014-9423, upgrade to MIT Kerberos 5 version 1.13.1 or later.
Which versions of MIT Kerberos 5 are affected by CVE-2014-9423?
Versions 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 are affected by CVE-2014-9423.
What kind of data leak is associated with CVE-2014-9423?
CVE-2014-9423 transmits uninitialized interposer data to clients, leading to potential data leaks.
Is there a workaround for CVE-2014-9423?
There is no specific workaround; the recommended action is to upgrade to a patched version of MIT Kerberos.