PT-2015-5837 · Mit+5 · Mit Kerberos 5+5

Greg Hudson · Publicado 2015-05-25 · Atualizado 2024-06-15 · CVE-2015-2694

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions 1.12.x through 1.13.1

Description The issue allows remote attackers to bypass an intended preauthentication requirement. This can be achieved by providing either zero bytes of data or an arbitrary realm name. The problem is related to the kdcpreauth modules in MIT Kerberos 5, specifically in the plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit srv.c files.

Recommendations For versions 1.12.x through 1.13.1, update to version 1.13.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the kdcpreauth modules until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2015-1898

CESA-2015_2154

CVE-2015-2694

OPENSUSE-SU-2024:10004-1

RHSA-2015:2154

RHSA-2015_2154

SUSE-SU-2015:1276-1

USN-2810-1

Produtos afetados

Alt Linux

Centos

Mit Kerberos 5

Red Hat

Suse

Ubuntu

Referências · 82

• https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-2695 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2694 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2010-1324 · Nota
• https://suse.com/security/cve/CVE-2014-9421 · Nota
• https://suse.com/security/cve/CVE-2016-3119 · Nota
• https://suse.com/security/cve/CVE-2015-2697 · Nota
• https://suse.com/support/update/announcement/2015/suse-su-20151276-1 · Nota
• https://ubuntu.com/security/CVE-2002-2443 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-2697 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-0285 · Nota
• https://suse.com/security/cve/CVE-2014-4345 · Nota
• https://suse.com/security/cve/CVE-2015-8631 · Nota
• https://linux.oracle.com/errata/ELSA-2015-2154.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-2694 · Aviso do Fabricante