CVE-2014-4343 Use after free in n/a
Remote attackers can cause denial of service or execute arbitrary code via crafted network traffic exploiting a double free in MIT Kerberos SPNEGO.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-4343?
CVE-2014-4343 is a high-severity use after free vulnerability in Debian Debian Linux, published on 14 Aug 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.
Weakness: CWE-415
Which versions are affected by CVE-2014-4343?
It affects 6 products.
Products include Debian Debian Linux, Mit Kerberos 5, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2014-4343?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2014-4343 being exploited?
There is no known exploitation of CVE-2014-4343 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2014-4343, GHSA-cmrr-h89w-fc55, UBUNTU-CVE-2014-4343.