CVE-2014-9423

{"id": "CVE-2014-9423", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-02-19T11:59:07.500", "references": [{"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html", "source": "cve@mitre.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html", "source": "cve@mitre.org"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html", "source": "cve@mitre.org"}, {"url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt", "source": "cve@mitre.org"}, {"url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2015/dsa-3153", "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/72503", "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/USN-2498-1", "source": "cve@mitre.org"}, {"url": "https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8dd22bc9526751610aaa255ead9c", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field."}, {"lang": "es", "value": "La funci\u00f3n svcauth_gss_accept_sec_context en lib/rpc/svc_auth_gss.c en MIT Kerberos 5 (tambi\u00e9n conocido como krb5) 1.11.x hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 trasmite datos intercalados no inicializados a clientes, lo que permite a atacantes remotos obtener informaci\u00f3n sensible de la memoria din\u00e1mica de procesos mediante la captura de trafico de la red para datos en un campo de manejo (handle)."}], "lastModified": "2020-01-21T15:46:57.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mit:kerberos_5:1.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D554BDC-CD7D-4572-B1E8-5F627F2C5916"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65BCD38A-33AD-4FD7-AF5B-8470B24C4139"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E11F9209-799A-428B-9513-DBD0F19C7BF4"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DA40FAA-B858-4282-8438-247E99FBB002"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65795542-D886-46C4-8ECB-4630078DF66A"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0A4C436-C3D7-469E-8895-8EEC9569EE86"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79A9FAE9-7219-4D6A-9E94-FFE20223537D"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA68BC90-FCFC-4C9B-8574-9029DB2358E9"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D0A28CB-173D-4676-B083-E3718213B840"}, {"criteria": "cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "169D00BD-344F-453C-BE7C-9DF0740080BB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}