CVE-2015-2697

Publication date 8 November 2015

Last updated 24 July 2024

Ubuntu priority

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
krb5	15.10 wily	Fixed 1.13.2+dfsg-2ubuntu0.1
	15.04 vivid	Fixed 1.12.1+dfsg-18ubuntu0.1
	14.04 LTS trusty	Fixed 1.12+dfsg-2ubuntu5.2
	12.04 LTS precise	Fixed 1.10+dfsg~beta1-2ubuntu0.7

How can I get the fixes?
What do statuses mean?
Patch details

Notes

sbeattie

kdc crash

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
krb5	Upstream: f0c094a

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2810-1
Kerberos vulnerabilities
12 November 2015

Other references

https://www.cve.org/CVERecord?id=CVE-2015-2697