Overview
The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. An attacker with network access to an application that depends on the vulnerable code path can cause the application to crash.
Description
A flawed logical condition allows a malicious actor to remotely trigger a NULL pointer dereference using a crafted negTokenInit token.
Impact
An attacker can use a specially crafted network packet to cause a vulnerable application to crash.
Solution
The latest version of code in the Heimdal master branch fixes the issue. However, the current stable release 7.7.0 does not include the fix.
Acknowledgements
Thanks to the International Continence Society for reporting this issue.
This document was written by Kevin Stephens.
Vendor Information
Other Information
Date Public:
2022-10-07
Date First Published:
2022-10-07
Date Last Updated:
2022-10-07 19:24 UTC
Document Revision:
1
Recent Posts
-
Fog ransomware targets SonicWall VPNs to breach corporate networks -
VU#164934: PDQ Deploy allows reuse of deleted credentials that can compromise a device and facilitate lateral movement
-
VU#123336: Vulnerable WiFi Alliance example code found in Arcadyan FMIMG51AX000J
-
Outage Report – 10/6/23 -
I had ChatGPT write a blog on the dangers of using ChatGPT, and the results were pretty amazing.