SB2015013013 - NULL pointer dereference in krb5 (Alpine package)

Description

This security bulletin contains information about 1 security vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2014-5354)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command. <a href="http://cwe.mitre.org/data/definitions/476. A remote attacker can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=0940a1ae3b296f0300f609e08af2ca26332c247f
• https://git.alpinelinux.org/aports/commit/?id=6c0f5b1515a834e3b68f2e199ccce1148f6c8054