Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 494062 (CVE-2013-1417)

Summary: <app-crypt/mit-krb5-1.11.4: Denial of Service (CVE-2013-1417)
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: minor CC: kerberos
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3 [glsa]
Package list:
Runtime testing required: ---

Description GLSAMaker/CVETool Bot gentoo-dev 2013-12-12 17:08:24 UTC
CVE-2013-1417 (
  do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka
  krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows
  remote authenticated users to cause a denial of service (daemon crash) via a
  TGS-REQ request that triggers an attempted cross-realm referral for a
  host-based service principal.
Comment 1 Chris Reffett (RETIRED) gentoo-dev Security 2013-12-12 17:10:14 UTC
Added to existing request.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2013-12-16 17:54:04 UTC
This issue was resolved and addressed in
 GLSA 201312-12 at
by GLSA coordinator Sergey Popov (pinkbyte).