CVE-2017-17439 (High) detected in heimdaleb87af0c2d189c25294c7daf483a47b03af80c2c

[mend-bolt-for-github[bot]]

CVE-2017-17439 - High Severity Vulnerability

Vulnerable Library - heimdaleb87af0c2d189c25294c7daf483a47b03af80c2c

Heimdal

Library home page: https://github.com/heimdal/heimdal.git

Found in HEAD commit: 816463d989cc5839c1cca2efb5bf2503408507fb

Found in base branches: stable/3.2, master

Vulnerable Source Files (1)

Vulnerability Details

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.

Publish Date: 2017-12-06

URL: CVE-2017-17439

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Release Date: 2017-12-05

Fix Resolution: Replace or update the following file: kerberos5.c

---

Step up your Open Source Security Game with Mend here