Bug 910457 (CVE-2014-5353) - VUL-1: CVE-2014-5353: krb5: NULL pointer dereference when using a ticket policy name as a password policy name
Summary: VUL-1: CVE-2014-5353: krb5: NULL pointer dereference when using a ticket poli...
Status: RESOLVED FIXED
Alias: CVE-2014-5353
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Deadline: 2015-03-12
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/111597/
Whiteboard: maint:running:60833:moderate
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-17 10:47 UTC by Alexander Bergmann
Modified: 2015-08-03 06:00 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2014-12-17 10:47:37 UTC
public via rh#1174543

The krb5_ldap_get_password_policy_from_dn function in
plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5)
before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to
cause a denial of service (daemon crash) via a successful LDAP query with no
results, as demonstrated by using an incorrect object type for a password
policy.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1174543
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5353
http://seclists.org/oss-sec/2014/q4/1055
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-5353.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5353
https://github.com/krb5/krb5/commit/04038bf3633c4b909b5ded3072dc88c8c419bf16
https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3
Comment 1 Swamp Workflow Management 2014-12-17 23:00:23 UTC
bugbot adjusting priority
Comment 2 Bernhard Wiedemann 2015-02-16 14:00:06 UTC
This is an autogenerated message for OBS integration:
This bug (910457) was mentioned in
https://build.opensuse.org/request/show/286336 13.2 / krb5
Comment 3 Swamp Workflow Management 2015-02-26 14:53:33 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-03-12.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/60833
Comment 4 Marcus Meissner 2015-03-11 10:04:28 UTC
ping? please submit
Comment 5 Bernhard Wiedemann 2015-03-11 15:00:07 UTC
This is an autogenerated message for OBS integration:
This bug (910457) was mentioned in
https://build.opensuse.org/request/show/290307 13.2+13.1 / krb5+krb5-mini
https://build.opensuse.org/request/show/290309 13.2+13.1 / krb5+krb5-mini
Comment 8 Swamp Workflow Management 2015-03-19 18:06:08 UTC
openSUSE-SU-2015:0542-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 910457,910458,918595
CVE References: CVE-2014-5353,CVE-2014-5354,CVE-2014-5355
Sources used:
openSUSE 13.2 (src):    krb5-1.12.2-12.1, krb5-mini-1.12.2-12.1
openSUSE 13.1 (src):    krb5-1.11.3-3.18.1, krb5-mini-1.11.3-3.18.1
Comment 9 Benjamin Brunner 2015-04-21 14:20:27 UTC
Peter, any status about SLE11-SP3?

Thanks in advance.
Comment 10 Victor Pereira 2015-06-16 06:51:28 UTC
ping. we still need a status on this to start an update. is SLE11-SP3 affected?
Comment 14 Swamp Workflow Management 2015-07-22 11:08:01 UTC
SUSE-SU-2015:1276-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 910457,910458,918595,928978
CVE References: CVE-2014-5353,CVE-2014-5354,CVE-2014-5355,CVE-2015-2694
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    krb5-1.12.1-16.1
SUSE Linux Enterprise Server 12 (src):    krb5-1.12.1-16.1
Comment 15 Swamp Workflow Management 2015-07-23 16:08:40 UTC
SUSE-SU-2015:1282-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 910457,910458,918595
CVE References: CVE-2014-5353,CVE-2014-5354,CVE-2014-5355
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    krb5-1.6.3-133.49.68.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    krb5-1.6.3-133.49.68.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    krb5-1.6.3-133.49.68.1, krb5-doc-1.6.3-133.49.68.2, krb5-plugins-1.6.3-133.49.68.1
SUSE Linux Enterprise Server 11-SP4 (src):    krb5-1.6.3-133.49.68.1, krb5-doc-1.6.3-133.49.68.2, krb5-plugins-1.6.3-133.49.68.1
SUSE Linux Enterprise Server 11-SP3 (src):    krb5-1.6.3-133.49.68.1, krb5-doc-1.6.3-133.49.68.2, krb5-plugins-1.6.3-133.49.68.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    krb5-1.6.3-133.49.68.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    krb5-1.6.3-133.49.68.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    krb5-1.6.3-133.49.68.1
Comment 16 Andreas Stieger 2015-07-24 08:41:31 UTC
fixed for all affected releases.
SLE 10 not affected.
Comment 17 Bernhard Wiedemann 2015-08-03 06:00:08 UTC
This is an autogenerated message for OBS integration:
This bug (910457) was mentioned in
https://build.opensuse.org/request/show/320084 42 / krb5