CVE-2011-0285 Use after free in n/a
Remote attackers can execute arbitrary code or crash the Kerberos admin daemon via a crafted password change request due to an invalid pointer free.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-0285?
CVE-2011-0285 is a critical use after free vulnerability in Mit Kerberos 5, published on 15 Apr 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.
Weakness: CWE-20
Which versions are affected by CVE-2011-0285?
It affects 1 product.
Linux distribution packages (32)
krb5 Red Hat:enterprise_linux:6::client | All versions | 0:1.8.2-3.el6_0.7 |
krb5-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:1.8.2-3.el6_0.7 |
krb5-devel Red Hat:enterprise_linux:6::client | All versions | 0:1.8.2-3.el6_0.7 |
krb5-libs Red Hat:enterprise_linux:6::client | All versions | 0:1.8.2-3.el6_0.7 |
krb5-pkinit-openssl Red Hat:enterprise_linux:6::client | All versions | 0:1.8.2-3.el6_0.7 |
krb5-server Red Hat:enterprise_linux:6::client | All versions | 0:1.8.2-3.el6_0.7 |
krb5-server-ldap Red Hat:enterprise_linux:6::client | All versions | 0:1.8.2-3.el6_0.7 |
krb5-workstation Red Hat:enterprise_linux:6::client | All versions | 0:1.8.2-3.el6_0.7 |
krb5 Red Hat:enterprise_linux:6::computenode | All versions | 0:1.8.2-3.el6_0.7 |
krb5-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:1.8.2-3.el6_0.7 |
krb5-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:1.8.2-3.el6_0.7 |
krb5-libs Red Hat:enterprise_linux:6::computenode | All versions | 0:1.8.2-3.el6_0.7 |
krb5-pkinit-openssl Red Hat:enterprise_linux:6::computenode | All versions | 0:1.8.2-3.el6_0.7 |
krb5-server Red Hat:enterprise_linux:6::computenode | All versions | 0:1.8.2-3.el6_0.7 |
krb5-server-ldap Red Hat:enterprise_linux:6::computenode | All versions | 0:1.8.2-3.el6_0.7 |
krb5-workstation Red Hat:enterprise_linux:6::computenode | All versions | 0:1.8.2-3.el6_0.7 |
krb5 Red Hat:enterprise_linux:6::server | All versions | 0:1.8.2-3.el6_0.7 |
krb5-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:1.8.2-3.el6_0.7 |
krb5-devel Red Hat:enterprise_linux:6::server | All versions | 0:1.8.2-3.el6_0.7 |
krb5-libs Red Hat:enterprise_linux:6::server | All versions | 0:1.8.2-3.el6_0.7 |
krb5-pkinit-openssl Red Hat:enterprise_linux:6::server | All versions | 0:1.8.2-3.el6_0.7 |
krb5-server Red Hat:enterprise_linux:6::server | All versions | 0:1.8.2-3.el6_0.7 |
krb5-server-ldap Red Hat:enterprise_linux:6::server | All versions | 0:1.8.2-3.el6_0.7 |
krb5-workstation Red Hat:enterprise_linux:6::server | All versions | 0:1.8.2-3.el6_0.7 |
krb5 Red Hat:enterprise_linux:6::workstation | All versions | 0:1.8.2-3.el6_0.7 |
krb5-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:1.8.2-3.el6_0.7 |
krb5-devel Red Hat:enterprise_linux:6::workstation | All versions | 0:1.8.2-3.el6_0.7 |
krb5-libs Red Hat:enterprise_linux:6::workstation | All versions | 0:1.8.2-3.el6_0.7 |
krb5-pkinit-openssl Red Hat:enterprise_linux:6::workstation | All versions | 0:1.8.2-3.el6_0.7 |
krb5-server Red Hat:enterprise_linux:6::workstation | All versions | 0:1.8.2-3.el6_0.7 |
krb5-server-ldap Red Hat:enterprise_linux:6::workstation | All versions | 0:1.8.2-3.el6_0.7 |
krb5-workstation Red Hat:enterprise_linux:6::workstation | All versions | 0:1.8.2-3.el6_0.7 |
Products include Mit Kerberos 5.
How do I fix CVE-2011-0285?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2011-0285 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-0285 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Mit Kerberos 5
Sources
Also known as DEBIAN-CVE-2011-0285, GHSA-rh86-pqp5-j43v, RHSA-2011:0447.