CVE-2018-5709 An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assign...
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/krb5(Ubuntu:22.04) | All versions | No fix listed |
| debian/krb5(Debian:12) | All versions | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-2 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-2+deb12u1 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-2+deb12u2 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-2+deb12u3 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-2+deb12u4 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-2+deb12u5 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-2+loong64 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-3 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-4 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-5 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-5.1 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-5.1~exp1 | No fix listed |
| debian/krb5(Debian:12) | = 1.20.1-6 | No fix listed |
| debian/krb5(Debian:12) | = 1.21.2-1 | No fix listed |
| debian/krb5(Debian:12) | = 1.21.3-1 | No fix listed |
| debian/krb5(Debian:12) | = 1.21.3-2 | No fix listed |
| debian/krb5(Debian:12) | = 1.21.3-3 | No fix listed |
| debian/krb5(Debian:12) | = 1.21.3-4 | No fix listed |
| debian/krb5(Debian:12) | = 1.21.3-5 | No fix listed |
| debian/krb5(Debian:12) | = 1.22.1-1 | No fix listed |
| debian/krb5(Debian:12) | = 1.22.1-2 | No fix listed |
| debian/krb5(Debian:12) | = 1.22.1-2.1 | No fix listed |
| debian/krb5(Debian:12) | = 1.22.1-3 | No fix listed |
Show 32 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/krb5(Debian:13) | All versions | No fix listed |
| debian/krb5(Debian:13) | = 1.21.3-5 | No fix listed |
| debian/krb5(Debian:13) | = 1.21.3-5+deb13u1 | No fix listed |
| debian/krb5(Debian:13) | = 1.22.1-1 | No fix listed |
| debian/krb5(Debian:13) | = 1.22.1-2 | No fix listed |
| debian/krb5(Debian:13) | = 1.22.1-2.1 | No fix listed |
| debian/krb5(Debian:13) | = 1.22.1-3 | No fix listed |
| debian/krb5(Debian:14) | All versions | No fix listed |
| debian/krb5(Debian:14) | = 1.21.3-5 | No fix listed |
| debian/krb5(Debian:14) | = 1.22.1-1 | No fix listed |
| debian/krb5(Debian:14) | = 1.22.1-2 | No fix listed |
| debian/krb5(Debian:14) | = 1.22.1-2.1 | No fix listed |
| debian/krb5(Debian:14) | = 1.22.1-3 | No fix listed |
| mit kerberos | <= 5-1.16 | No fix listed |
| alpine/krb5(Alpine:v3.10) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.11) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.12) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.13) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.14) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.15) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.16) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.17) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.18) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.19) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.20) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.21) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.22) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.23) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.24) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.7) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.8) | < 1.15.3-r0 | 1.15.3-r0 |
| alpine/krb5(Alpine:v3.9) | < 1.15.3-r0 | 1.15.3-r0 |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-5709 vendor-advisory
- github.com third-party-advisory
- [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar mailing-list
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking