Debian Security Advisory DSA 3395-1 (krb5 - security update)

Several vulnerabilities were discovered in krb5, the MIT implementation of Kerberos. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-2695 It was discovered that applications which call gss_inquire_context() on a partially-established SPNEGO context can cause the GSS-API library to read from a pointer using the wrong type, leading to a process crash. CVE-2015-2696 It was discovered that applications which call gss_inquire_context() on a partially-established IAKERB context can cause the GSS-API library to read from a pointer using the wrong type, leading to a process crash. CVE-2015-2697 It was discovered that the build_principal_va() function incorrectly handles input strings. An authenticated attacker can take advantage of this flaw to cause a KDC to crash using a TGS request with a large realm field beginning with a null byte.

krb5 on Debian Linux

This check tests the installed software version using the apt package manager.

For the oldstable distribution (wheezy), these problems have been fixed in version 1.10.1+dfsg-5+deb7u4. For the stable distribution (jessie), these problems have been fixed in version 1.12.1+dfsg-19+deb8u1. For the testing distribution (stretch), these problems have been fixed in version 1.13.2+dfsg-3. For the unstable distribution (sid), these problems have been fixed in version 1.13.2+dfsg-3. We recommend that you upgrade your krb5 packages.