The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdal | Jan 3, 2018 | Dec 6, 2017 |
| Debian | — | Upgrade heimdal | Dec 8, 2017 | Dec 6, 2017 |
| Suse | — | Upgrade libheimdalUpgrade libheimdal-debugsourceUpgrade libheimdal-develUpgrade libheimdal-debuginfo | Dec 12, 2017 | Dec 6, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub