[ GLSA 202011-17 ] MIT Kerberos 5

[GLSA]

Gentoo Linux Security Advisory

Title: MIT Kerberos 5: Denial of service (GLSA 202011-17)
Severity: low
Exploitable: remote
Date: 2020-11-16
Bug(s): #753281
ID: 202011-17

Synopsis

A vulnerability in MIT Kerberos 5 could lead to a Denial of Service
condition.


Background

The MIT Kerberos 5 implementation provides a command line telnet client
which is used for remote login via the telnet protocol.


Affected Packages

Package: app-crypt/mit-krb5
Vulnerable: < 1.18.2-r2
Unaffected: >= 1.18.2-r2
Architectures: All supported architectures


Description

It was discovered that MIT Kerberos network authentication system, krb5,
did not properly handle ASN.1-encoded Kerberos messages.


Impact

A remote attacker could send a specially crafted Kerberos message,
possibly resulting in a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All MIT Kerberos 5 users should upgrade to the latest version: