Debian Bug report logs -
#889684
krb5: CVE-2018-5709
Reported by: Salvatore Bonaccorso <carnil@debian.org>
Date: Mon, 5 Feb 2018 20:51:01 UTC
Severity: important
Tags: security, upstream
Found in version krb5/1.16-2
Done: Benjamin Kaduk <kaduk@mit.edu>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, team@security.debian.org, Sam Hartman <hartmans@debian.org>:
Bug#889684; Package src:krb5.
(Mon, 05 Feb 2018 20:51:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, team@security.debian.org, Sam Hartman <hartmans@debian.org>.
(Mon, 05 Feb 2018 20:51:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: krb5
Version: 1.16-2
Severity: important
Tags: security upstream
Hi,
the following vulnerability was published for krb5, filling a bug to
track the issue once more details are available.
CVE-2018-5709[0]:
| An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16.
| There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that
| can store 16-bit data but unknowingly the developer has assigned a "u4"
| variable to it, which is for 32-bit data. An attacker can use this
| vulnerability to affect other artifacts of the database as we know that
| a Kerberos database dump file contains trusted data.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2018-5709
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
Please adjust the affected versions in the BTS as needed, once known.
Regards,
Salvatore
Reply sent
to Benjamin Kaduk <kaduk@mit.edu>:
You have taken responsibility.
(Sun, 29 Apr 2018 17:21:03 GMT) (full text, mbox, link).
Notification sent
to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer.
(Sun, 29 Apr 2018 17:21:03 GMT) (full text, mbox, link).
Message #10 received at 889684-done@bugs.debian.org (full text, mbox, reply):
This codepath only runs on trusted input, so the potential integer
overflow is a non-issue; closing.
-Ben
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Mon, 28 May 2018 07:29:32 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 13:38:35 2019;
Machine Name:
beach
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon