Bug#704775: krb5: KDC TGS-REQ null deref (CVE-2013-1416)

2013-04-07 Thread Benjamin Kaduk
On Sat, 6 Apr 2013, Michael Gilbert wrote: I'm not seeing any new kerberos releases: http://web.mit.edu/kerberos/krb5-1.10 Current Kerberos Security Team policy is to not issue security advisories for null pointer dereference crashes. We assign CVE numbers for tracking, but do not delay

Bug#704775: krb5: KDC TGS-REQ null deref (CVE-2013-1416)

2013-04-06 Thread Michael Gilbert
I'm not seeing any new kerberos releases: http://web.mit.edu/kerberos/krb5-1.10 Is this perhaps not meant to be public knowledge yet? Best wishes, Mike -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact

Bug#704775: krb5: KDC TGS-REQ null deref (CVE-2013-1416)

2013-04-05 Thread Benjamin Kaduk
Package: krb5-kdc Version: 1.10.1+dfsg-4+nmu1 Severity: serious Upstream has patched against CVE-2013-1416; Debian should as well. By sending an unusual but valid TGS-REQ, an authenticated remote attacker can cause the KDC process to crash by dereferencing a null pointer. Only krb5 releases