GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the cb
and sh
buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main gss_accept_sec_context
entry point. This will likely trigger an assertion failure in free
, causing a denial-of-service. This issue is fixed in version 1.2.0.
{ "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "gss-ntlmssp", "binary_version": "0.7.0-3~ubuntu0.16.04.1+esm1" }, { "binary_name": "gss-ntlmssp-dbgsym", "binary_version": "0.7.0-3~ubuntu0.16.04.1+esm1" }, { "binary_name": "gss-ntlmssp-dev", "binary_version": "0.7.0-3~ubuntu0.16.04.1+esm1" } ] }
{ "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "gss-ntlmssp", "binary_version": "0.7.0-4ubuntu0.18.04.1~esm1" }, { "binary_name": "gss-ntlmssp-dbgsym", "binary_version": "0.7.0-4ubuntu0.18.04.1~esm1" }, { "binary_name": "gss-ntlmssp-dev", "binary_version": "0.7.0-4ubuntu0.18.04.1~esm1" } ] }
{ "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "gss-ntlmssp", "binary_version": "0.7.0-4ubuntu0.20.04.1~esm1" }, { "binary_name": "gss-ntlmssp-dbgsym", "binary_version": "0.7.0-4ubuntu0.20.04.1~esm1" }, { "binary_name": "gss-ntlmssp-dev", "binary_version": "0.7.0-4ubuntu0.20.04.1~esm1" } ] }
{ "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "gss-ntlmssp", "binary_version": "0.7.0-4ubuntu0.22.04.1~esm1" }, { "binary_name": "gss-ntlmssp-dbgsym", "binary_version": "0.7.0-4ubuntu0.22.04.1~esm1" }, { "binary_name": "gss-ntlmssp-dev", "binary_version": "0.7.0-4ubuntu0.22.04.1~esm1" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "gss-ntlmssp", "binary_version": "1.2.0-1build3" }, { "binary_name": "gss-ntlmssp-dbgsym", "binary_version": "1.2.0-1build3" }, { "binary_name": "gss-ntlmssp-dev", "binary_version": "1.2.0-1build3" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "gss-ntlmssp", "binary_version": "1.2.0-1build3" }, { "binary_name": "gss-ntlmssp-dbgsym", "binary_version": "1.2.0-1build3" }, { "binary_name": "gss-ntlmssp-dev", "binary_version": "1.2.0-1build3" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "gss-ntlmssp", "binary_version": "1.2.0-1build3" }, { "binary_name": "gss-ntlmssp-dbgsym", "binary_version": "1.2.0-1build3" }, { "binary_name": "gss-ntlmssp-dev", "binary_version": "1.2.0-1build3" } ] }