CVE-2011-0285 The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to e...
HighCVSS 10.0
EPSS 20.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos 5 | = 1.7 | No fix listed |
| mit kerberos 5 | = 1.7.1 | No fix listed |
| mit kerberos 5 | = 1.8 | No fix listed |
| mit kerberos 5 | = 1.8.1 | No fix listed |
| mit kerberos 5 | = 1.8.2 | No fix listed |
| mit kerberos 5 | = 1.8.3 | No fix listed |
| mit kerberos 5 | = 1.9 | No fix listed |
| debian/krb5(Debian:12) | < 1.9.1+dfsg-1 | 1.9.1+dfsg-1 |
| debian/krb5(Debian:13) | < 1.9.1+dfsg-1 | 1.9.1+dfsg-1 |
| debian/krb5(Debian:14) | < 1.9.1+dfsg-1 | 1.9.1+dfsg-1 |
References
- Debian Security Tracker CVE-2011-0285 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org
- krbdev.mit.edu
- FEDORA-2011-5333 vendor-advisory
- 71789 vdb-entry
- 44125 third-party-advisory
- 44181 third-party-advisory
- 44196 third-party-advisory
- 8200 third-party-advisory
- web.mit.edu patch vendor-advisory
- MDVSA-2011:077 vendor-advisory
- RHSA-2011:0447 vendor-advisory
- 20110413 MITKRB5-SA-2011-004 kadmind invalid pointer free() [CVE-2011-0285] mailing-list
- 47310 vdb-entry
- 1025320 vdb-entry
- ADV-2011-0936 vdb-entry
- ADV-2011-0986 vdb-entry
- ADV-2011-0997 vdb-entry
- openSUSE-SU-2011:0348 vendor-advisory