CVE-2015-2695: Medium severity kerberos vulnerability
lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gssinquirecontext call.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2695?
CVE-2015-2695 has a medium severity rating, allowing remote attackers to trigger a denial of service.
How do I fix CVE-2015-2695?
To fix CVE-2015-2695, update your MIT Kerberos 5 installation to version 1.14 or later.
What systems are affected by CVE-2015-2695?
CVE-2015-2695 affects MIT Kerberos 5 versions before 1.14 and several versions of Ubuntu, Debian, SUSE, and Oracle Solaris.
Is CVE-2015-2695 being actively exploited?
At the time of the disclosure, there were no known active exploits for CVE-2015-2695, but it is recommended to patch systems promptly.
What kind of attack vector does CVE-2015-2695 utilize?
CVE-2015-2695 utilizes crafted SPNEGO packets to exploit the vulnerable gss_inquire_context function.