Buffer overflow in ksu in Kerberos 5 allows local users to gain root privileges.
Buffer overflow in krshd in Kerberos 5 allows remote attackers to gain root privileges.
Buffer overflow in krbrdreq function in Kerberos 4 and 5 allows remote attackers to gain root privileges.
Buffer overflow in krb425convprincipal function in Kerberos 5 allows remote attackers to gain root privileges.
Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the emsg variable in the kerberrreply function.
Kerberos 4 KDC program does not properly check for null termination of AUTHMSGKDCREQUEST requests, which allows remote attackers to cause a denial of service via a malformed request.
Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the localrealm variable in the processv4 function.
Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the lastrealm variable in the settgtkey function.
Kerberos 4 KDC program improperly frees memory twice (aka "double-free"), which allows remote attackers to cause a denial of service.
The kadmserin function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
Multiple buffer overflows in krb5anametolocalname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
The asn1decodegeneraltime function in lib/krb5/asn.1/asn1decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
A flaw was found in krb5 certificate EKU validation which could lead to improper authorization if a forged certificate with the right EKU and no SAN is used.
The PKINIT certauth eku module should never authoritatively authorize a certificate, because an extended key usage does not establish a relationship between the certificate and any specific user; it only establishes that the certificate was created for PKINIT client authentication.
Upstream bug:
https://github.com/krb5/krb5/pull/694
Upstream patch:
https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2 https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196 https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627d