Threats affecting pkg:github/zeek

Zeek versions prior to 8.0.9 contain a null pointer dereference vulnerability in the Kerberos protocol analyzer. This flaw allows unauthenticated remote attackers to crash the Zeek sensor by sending a specially crafted KRB_ERROR message with specific PA-DATA elements. The vulnerability arises from a parser and analyzer state mismatch in proc_padata(), leading to dereferencing an uninitialized field and causing a crash. The issue can be triggered by a single UDP or TCP packet to port 88 without requiring any credentials or prior authentication. The vulnerability is fixed in Zeek 8.0.9.

Zeek versions before 8.0.9 have a vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause a denial of service by sending a crafted FTP control session. The flaw is due to uncontrolled memory consumption triggered by a large ADAT control line during AUTH GSSAPI negotiation, which causes the internal buffer to grow without limits during base64 decoding.