CVE-2017-17439
Summary
| CVE | CVE-2017-17439 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2017-12-06 15:29:00 UTC |
|---|
| Updated | 2017-12-30 02:29:00 UTC |
|---|
| Description | In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Debian -- Security Information -- DSA-4055-1 heimdal |
DEBIAN |
www.debian.org |
Third Party Advisory |
| #878144 - CVE-2017-17439: Remote unauthenticated DoS in Heimdal-KDC 7.1 - Debian Bug report logs |
CONFIRM |
bugs.debian.org |
Issue Tracking, Mailing List, Third Party Advisory |
| Security: Avoid NULL structure pointer member dereference · heimdal/heimdal@1a6a6e4 · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| Heimdal security advisories |
CONFIRM |
h5l.org |
|
| Segfaults after receiving invalid AS-REQ |
MISC |
www.h5l.org |
Third Party Advisory |
| Heimdal Software · GitHub |
CONFIRM |
www.h5l.org |
|
| Remote unauthenticated DoS in Heimdal-KDC 7.1 · Issue #353 · heimdal/heimdal · GitHub |
CONFIRM |
github.com |
Patch, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500244 Alpine Linux Security Update for heimdal
- 503992 Alpine Linux Security Update for heimdal
