PT-2016-3940 · Mit+4 · Mit Kerberos 5+4

Greg Hudson · Published 2016-02-04 · Updated 2024-06-15 · CVE-2015-8630

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (aka krb5) versions 1.12.x through 1.13.x before 1.13.4 MIT Kerberos 5 (aka krb5) versions 1.14.x before 1.14.1

Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon crash due to a NULL pointer dereference. This occurs when the KADM5 POLICY is specified with a NULL policy name, affecting the kadm5 create principal 3 and kadm5 modify principal functions.

Recommendations For versions 1.12.x through 1.13.x before 1.13.4, update to version 1.13.4 or later. For versions 1.14.x before 1.14.1, update to version 1.14.1 or later. As a temporary workaround, consider restricting access to the kadm5 create principal 3 and kadm5 modify principal functions until a patch is available.

Fix

Related Identifiers

ALT-PU-2016-1392

CESA-2016_0532

CVE-2015-8630

DSA-3466-1

MGASA-2016-0052

OPENSUSE-SU-2024:10004-1

RHSA-2016:0532

RHSA-2016_0532

SUSE-SU-2016:0429-1

Affected Products

Alt Linux

Centos

Mit Kerberos 5

Red Hat

Suse

References · 83

• https://github.com/krb5/krb5/commit/b863de7fbf080b15e347a736fdda0a82d42f4f6b · Patch
• https://ubuntu.com/security/CVE-2015-8630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8630 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10004-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00059.html · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2015-8630 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8630 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8630 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8630 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8630 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00110.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0052 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2016-January/176451.html · Vendor Advisory
• http://debian.org/security/2016/dsa-3466 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0052.html · Security Note