PT-2013-1201 · Mit+3 · Mit Kerberos 5+3

Published 2013-11-16 · Updated 2020-01-21 · CVE-2013-6800

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (aka krb5) versions 1.10.x through 1.11.3

Description The issue affects the Key Distribution Center (KDC) in MIT Kerberos 5 due to an unspecified third-party database module. It allows remote authenticated users to cause a denial of service via a crafted request, resulting in a NULL pointer dereference and daemon crash. Additionally, multiple vulnerabilities in the mit-krb5 package prior to version 1.11.4 may lead to breaches of confidentiality, integrity, and availability of protected information, with potential for remote exploitation.

Recommendations For versions 1.10.x through 1.11.3, update to version 1.11.4 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-09675

CESA-2014_1389

CVE-2013-6800

RHSA-2014:1245

RHSA-2014:1389

RHSA-2014_1245

RHSA-2014_1389

USN-2310-1

Affected Products

Centos

Mit Kerberos 5

Red Hat

Ubuntu

References · 22

• https://github.com/krb5/krb5/commit/c2ccf4197f697c4ff143b8a786acdd875e70a89d · Patch
• https://ubuntu.com/security/CVE-2014-4344 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-1415 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09675 · Security Note
• https://osv.dev/vulnerability/USN-2310-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-1016 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4345 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-1389.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6800 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6800 · Security Note
• https://ubuntu.com/security/CVE-2014-4341 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6800 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-6800 · Security Note