|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2004-0772: heimdal: double free errors from MIT krb5, may they affect us too? | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Thomas Biege <thomas> |
| Component: | Incidents | Assignee: | Vladimir Nadvornik <nadvornik> |
| Status: | RESOLVED INVALID | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | CVE-2004-0772: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Thomas Biege
2004-07-14 20:32:03 UTC
<!-- SBZ_reproduce --> - Where can I get more details? i think you have to get in contact with Tom Yu <tlyu@mit.edu>. private mail from CERT: Hello, We have received the following report from MIT regarding vulnerabilities in MIT Kerberos 5. MIT has asked that vendors using MIT krb5 contact them directly for further technical details, including patches. We do not presently have this information. Contact information for MIT krb5: Tom Yu <tlyu@mit.edu> <http://web.mit.edu/kerberos/contact.html> We will be publishing Vulnerability Notes and possibly an Alert. We'd appreciate status information and/or vendor statements when possible. As noted below, MIT is planning for a mid-August public release. ====================================================================== MIT Kerberos 5 Vulnerability Reports ====================================================================== The MIT Kerberos Development Team is aware of the following vulnerabilities in the MIT krb5 software. We are targeting mid-August for public disclosure. Please do not publicly disseminate this information prior to our public disclosure. At this time, we prefer to communicate details of the vulnerabilities via secure channels, preferably via PGP. We prefer to only communicate details with vendors actually shipping our code. If you are a vendor shipping our code and would like additional details, please provide us with a PGP key for your organization's security contact. The vulnerabilities (with CVE names) are: CAN-2004-0642 [VU#795632] in krb5-1.3.4 and earlier, double-free errors may allow unauthenticated remote attackers to execute arbitrary code on KDC or clients CAN-2004-0643 [VU#866472] in krb5-1.3.1 and earlier, double-free errors may allow authenticated attackers to execute arbitrary code on application servers CAN-2004-0644 [VU#550464] in krb5-1.3.4 and earlier, there is remote denial-of-service vulnerability in the KDC and libraries ====================================================================== Regards, - Art Art Manion -- CERT Coordination Center <http://www.cert.org/> <cert@cert.org> +1 412-268-7090 AB 21 AE 19 EE 89 A1 5A D7 D8 0C 44 2D 87 F6 96 coordinated release dates from vendor-sec: CAN-2004-0642/3/4 krb5 Aug 31 ????UTC CAN-2004-0772 krb5 Aug 31 ????UTC I have seen this has gone public. Whats our status? The heimdal code is is completely different and does not contain these bugs. CVE-2004-0772: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) |