Home / vulnerabilities Mandriva Linux Security Advisory 2011-159
Posted on 23 October 2011
Source : packetstormsecurity.org Link
Mandriva Linux Security Advisory 2011-159 - The kdb_ldap plugin in the Key Distribution Center in MIT Kerberos 5 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service via a kinit operation with incorrect string case for the realm, related to the is_principal_in_realm, krb5_set_error_message, krb5_ldap_get_principal, and process_as_req functions. The krb5_ldap_lockout_audit function in the Key Distribution Center 1.8 through 1.8.4 and 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service via unspecified vectors, related to the locked_check_p function. The lookup_lockout_policy function in the Key Distribution Center in MIT Kerberos 5 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors. The updated packages have been patched to correct these issues.
