CVE-2017-17439: Null Pointer Dereference
First published: Tue Oct 10 2017(Updated: )
In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Debian Debian Linux | =9.0 | |
| Heimdal Project Heimdal | <=7.4.0 | |
| debian/heimdal | 7.5.0+dfsg-3 7.5.0+dfsg-3+deb10u2 7.7.0+dfsg-2+deb11u3 7.8.git20221117.28daf24+dfsg-2 7.8.git20221117.28daf24+dfsg-3 | |
| debian/heimdal | <=7.1.0+dfsg-13<=7.4.0.dfsg.1-2<=7.1.0+dfsg-13+deb9u1 | 7.1.0+dfsg-13+deb9u2 7.5.0+dfsg-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://h5l.org/advisories.html?show=2017-12-08
- http://www.h5l.org/pipermail/heimdal-announce/2017-December/000008.html
- http://www.h5l.org/pipermail/heimdal-discuss/2017-August/000259.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878144
- https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887
- https://github.com/heimdal/heimdal/issues/353
- https://www.debian.org/security/2017/dsa-4055
- https://github.com/heimdal/heimdal/commit/749d377fa357351a7bbba51f8aae72cdf0629592
- https://security-tracker.debian.org/tracker/CVE-2017-17439
- https://github.com/heimdal/heimdal/blob/master/lib/asn1/der_length.c
- https://github.com/heimdal/heimdal/issues/
- collector/nvd-index
- collector/security-tracker-debian
- collector/debian-bugs
- alias/CVE-2017-17439
- agent/weakness
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/heimdal project
- canonical/heimdal project heimdal
- version/heimdal project heimdal/7.4.0
- package-manager/debian