CVE-2014-5354 plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NUL...
LowCVSS 3.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/krb5(Debian:12) | < 1.12.1+dfsg-16 | 1.12.1+dfsg-16 |
| debian/krb5(Debian:13) | < 1.12.1+dfsg-16 | 1.12.1+dfsg-16 |
| debian/krb5(Debian:14) | < 1.12.1+dfsg-16 | 1.12.1+dfsg-16 |
| mit kerberos | = 5_1.13 | No fix listed |
| mit kerberos 5 | = 1.12 | No fix listed |
| mit kerberos 5 | = 1.12.1 | No fix listed |
| mit kerberos 5 | = 1.12.2 | No fix listed |
References
- Debian Security Tracker CVE-2014-5354 vendor-advisory
- openSUSE-SU-2015:0542 vendor-advisory
- 71680 vdb-entry
- 1031376 vdb-entry
- USN-2498-1 vendor-advisory
- github.com
- bugs.debian.org issue-tracking