Published: 16/12/2014 Updated: 02/02/2021

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

VMScore: 312

Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P

The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) prior to 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mit kerberos 5
redhat enterprise linux desktop 6.0
redhat enterprise linux eus 6.6
redhat enterprise linux eus 7.3
redhat enterprise linux eus 7.4
redhat enterprise linux eus 7.5
redhat enterprise linux eus 7.6
redhat enterprise linux eus 7.7
redhat enterprise linux server 6.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 6.6
redhat enterprise linux server aus 7.3
redhat enterprise linux server aus 7.4
redhat enterprise linux server aus 7.6
redhat enterprise linux server aus 7.7
redhat enterprise linux server tus 6.6
redhat enterprise linux server tus 7.3
redhat enterprise linux server tus 7.6
redhat enterprise linux server tus 7.7
redhat enterprise linux workstation 6.0
fedoraproject fedora 22
debian debian linux 7.0
canonical ubuntu linux 10.04
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
canonical ubuntu linux 14.10
oracle solaris 10
oracle solaris 11.2
opensuse opensuse 13.1
opensuse opensuse 13.2

Several security issues were fixed in Kerberos ...

Debian Bug report logs - #773226 CVE-2014-5353: misused policy name crashes KDC Package: krb5-kdc-ldap; Maintainer for krb5-kdc-ldap is Sam Hartman <hartmans@debianorg>; Source for krb5-kdc-ldap is src:krb5 (PTS, buildd, popcon) Reported by: Benjamin Kaduk <kaduk@MITEDU> Date: Mon, 15 Dec 2014 20:09:06 UTC Severit ...

Debian Bug report logs - #773228 CVE-2014-5354: kadmin crashes on keyless principals Package: krb5-kdc-ldap; Maintainer for krb5-kdc-ldap is Sam Hartman <hartmans@debianorg>; Source for krb5-kdc-ldap is src:krb5 (PTS, buildd, popcon) Reported by: Benjamin Kaduk <kaduk@MITEDU> Date: Mon, 15 Dec 2014 20:09:17 UTC Se ...

A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens An attacker able to make an application using the GSS-API library (libgssapi) could call the gss_process_context_token() function and use this flaw to crash that application (CVE-2014-5352) If kadmind were used with an LDAP b ...

CWE-476 https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3 http://www.mandriva.com/security/advisories?name=MDVSA-2015:009 http://www.securityfocus.com/bid/71679 http://advisories.mageia.org/MGASA-2014-0536.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226 http://rhn.redhat.com/errata/RHSA-2015-0439.html http://www.ubuntu.com/usn/USN-2498-1 http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html http://rhn.redhat.com/errata/RHSA-2015-0794.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.securitytracker.com/id/1031376 https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html https://usn.ubuntu.com/2498-1/https://nvd.nist.gov

CVE-2014-5353

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect