NVD

Id
36124  
Name
CVE-2014-9421  
Description
The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.  
Reject
 
CVSS Version
2  
CVSS Score
9  
Severity
High  
CVSS Base Score
9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2015-02-19  
Modified Date
2017-01-02  
Seq
2014-9421  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
184616 36124 CVE-2014-9421 FEDORA-2015-2382  View
184617 36124 CVE-2014-9421 FEDORA-2015-2347  View
184618 36124 CVE-2014-9421 SUSE-SU-2015:0257  View
184619 36124 CVE-2014-9421 SUSE-SU-2015:0290  View
184620 36124 CVE-2014-9421 openSUSE-SU-2015:0255  View
184621 36124 CVE-2014-9421 RHSA-2015:0439  View
184622 36124 CVE-2014-9421 RHSA-2015:0794  View
184623 36124 CVE-2014-9421 http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt  View
184624 36124 CVE-2014-9421 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt  View
184625 36124 CVE-2014-9421 DSA-3153  View
184626 36124 CVE-2014-9421 MDVSA-2015:069  View
184627 36124 CVE-2014-9421 72496  View
184628 36124 CVE-2014-9421 USN-2498-1  View
184629 36124 CVE-2014-9421 https://github.com/krb5/krb5/commit/a197e92349a4aa2141b5dff12e9dd44c2a2166e3  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19049 JVNDB-2014-007924 MIT Kerberos 5 の lib/rpc/auth_gssapi_misc.c の auth_gssapi_unwrap_data 関数におけるサービス運用妨害 (DoS) の脆弱性 MIT Kerberos 5 (別名 krb5) の lib/rpc/auth_gssapi_misc.c の auth_gssapi_unwrap_data 関数は、部分的な XDR のデシリアライズを適切に処理しないため、サービス運用妨害 (解放済みメモリの使用、二重解放、およびデーモンクラッシュ) 状態にされる、または任意のコードを実行される脆弱性が存在します。 CVE-2014-9421 76714 CVE-2014-9421 36124 9 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007924.html 2014-12-28 2015-06-08 View