CVE-2021-44758: Null Pointer Dereference

Q: What is CVE-2021-44758?

CVE-2021-44758 is a vulnerability in Heimdal before version 7.7.1 that allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor.

Q: How severe is CVE-2021-44758?

CVE-2021-44758 is considered high severity with a CVSS score of 7.5.

Q: How can attackers exploit CVE-2021-44758?

Attackers can exploit CVE-2021-44758 by sending a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to the SPNEGO acceptor.

Q: Which software versions are affected by CVE-2021-44758?

Heimdal versions before 7.7.1 are affected by CVE-2021-44758.

Q: How can I fix CVE-2021-44758?

To fix CVE-2021-44758, upgrade to Heimdal version 7.7.1 or later.

Published Dec 26, 2022

Updated

Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferredmechtype of GSSCNOOID and a nonzero initialresponse value to sendaccept.

Affected Software

2 affected componentsFixes available

Heimdal Project Heimdal<7.7.1

debian/heimdal

7.8.git20221117.28daf24+dfsg-27.8.git20221117.28daf24+dfsg-9+deb13u17.8.git20240113.1b4565a+dfsg-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/heimdal to a version that resolves this vulnerability.
Fixed in 7.8.git20221117.28daf24+dfsg-2Fixed in 7.8.git20221117.28daf24+dfsg-9+deb13u1Fixed in 7.8.git20240113.1b4565a+dfsg-2

Event History

Dec 26, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-5287

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3206-1

Frequently Asked Questions

What is CVE-2021-44758?