Double Free Vulnerability in SPNEGO Initiator in MIT Kerberos 5

CVE-2014-4343 · HIGH Severity

AV:N/AC:H/AU:N/C:C/I:C/A:C

Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

Learn more about our Cis Benchmark Audit For Mit Kerberos.