CVE-2014-4342
UnknownEPSS 6.52%
Last modified
CVE-2014-4342 is a vulnerability of currently unknown severity. MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.. EPSS estimates a 6.52% chance of exploitation in the next 30 days.
Description
MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Debian | Debian Linux | 7.0 | — |
| Mit | Kerberos | 5-1.8 | Alpha1 |
| Mit | Kerberos | 5-1.10.5 | — |
| Mit | Kerberos | 5-1.10.6 | — |
| Mit | Kerberos | 5-1.10.7 | — |
| Mit | Kerberos 5 | 1.7 | — |
| Mit | Kerberos 5 | 1.7.1 | — |
| Mit | Kerberos 5 | 1.8 | — |
| Mit | Kerberos 5 | 1.8.1 | — |
| Mit | Kerberos 5 | 1.8.2 | — |
| Mit | Kerberos 5 | 1.8.3 | — |
| Mit | Kerberos 5 | 1.8.4 | — |
| Mit | Kerberos 5 | 1.8.5 | — |
| Mit | Kerberos 5 | 1.8.6 | — |
| Mit | Kerberos 5 | 1.9 | — |
| Mit | Kerberos 5 | 1.9.1 | — |
| Mit | Kerberos 5 | 1.9.2 | — |
| Mit | Kerberos 5 | 1.9.3 | — |
| Mit | Kerberos 5 | 1.9.4 | — |
| Mit | Kerberos 5 | 1.10 | — |
| Mit | Kerberos 5 | 1.10.1 | — |
| Mit | Kerberos 5 | 1.10.2 | — |
| Mit | Kerberos 5 | 1.10.3 | — |
| Mit | Kerberos 5 | 1.10.4 | — |
| Mit | Kerberos 5 | 1.11 | — |
| Mit | Kerberos 5 | 1.11.1 | — |
| Mit | Kerberos 5 | 1.11.2 | — |
| Mit | Kerberos 5 | 1.11.3 | — |
| Mit | Kerberos 5 | 1.11.4 | — |
| Mit | Kerberos 5 | 1.12 | — |
| Mit | Kerberos 5 | 1.12.1 | — |
| Redhat | Enterprise Linux Desktop | 7.0 | — |
| Redhat | Enterprise Linux Hpc Node | 7.0 | — |
| Redhat | Enterprise Linux Server | 7.0 | — |
| Redhat | Enterprise Linux Workstation | 7.0 | — |
References
- http://advisories.mageia.org/MGASA-2014-0345.htmlThird Party Advisory
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949Issue Tracking, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0439.htmlThird Party Advisory
- http://secunia.com/advisories/59102Not Applicable
- http://secunia.com/advisories/60082Not Applicable
- http://www.debian.org/security/2014/dsa-3000Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:165Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatch, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/68908Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1030706Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94903Third Party Advisory, VDB Entry
- https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73Issue Tracking, Patch, Third Party Advisory
- http://advisories.mageia.org/MGASA-2014-0345.htmlThird Party Advisory
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949Issue Tracking, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0439.htmlThird Party Advisory
- http://secunia.com/advisories/59102Not Applicable
- http://secunia.com/advisories/60082Not Applicable
- http://www.debian.org/security/2014/dsa-3000Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:165Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatch, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/68908Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1030706Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94903Third Party Advisory, VDB Entry
- https://github.com/krb5/krb5/commit/e6ae703ae597d798e310368d52b8f38ee11c6a73Issue Tracking, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-4342?
MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.
How severe is CVE-2014-4342?
Severity scoring for CVE-2014-4342 is pending analysis. The EPSS model estimates a 6.52% probability of exploitation in the next 30 days.
How do I fix CVE-2014-4342?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2014-4342?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST