CVE-2015-8630 - The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_princ

CVE-2015-8630

Summary

The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a>

References

Vulnerable Configurations

cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.3:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.3:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.4:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.4:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.5:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.5:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.13.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.13.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.13.2:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.13.2:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.13.3:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.13.3:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.14:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.14:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.14:alpha1:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.14:alpha1:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.14:beta1:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.14:beta1:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.14:beta2:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.14:beta2:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 21-01-2020 - 15:47)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

redhat via4

advisories

rhsa

id	RHSA-2016:0532

rpms

krb5-debuginfo-0:1.13.2-12.el7_2
krb5-devel-0:1.13.2-12.el7_2
krb5-libs-0:1.13.2-12.el7_2
krb5-pkinit-0:1.13.2-12.el7_2
krb5-server-0:1.13.2-12.el7_2
krb5-server-ldap-0:1.13.2-12.el7_2
krb5-workstation-0:1.13.2-12.el7_2

refmap via4

confirm	http://krbdev.mit.edu/rt/Ticket/Display.html?id=8342 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html https://github.com/krb5/krb5/commit/b863de7fbf080b15e347a736fdda0a82d42f4f6b
debian	DSA-3466
sectrack	1034915
suse	openSUSE-SU-2016:0406 openSUSE-SU-2016:0501

Last major update

21-01-2020 - 15:47

Published

13-02-2016 - 02:59

Last modified

21-01-2020 - 15:47