PT-2018-2734 · Mit+4 · Mit-Krb5+4

Pooja Anil + 1 · Published 2018-01-03 · Updated 2025-05-05 · CVE-2018-5729

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MIT krb5 versions 1.6 or later

Description The issue is related to a null pointer dereference in the Kerberos authentication protocol, which can lead to a denial of service. An authenticated kadmin with permission to add principals to an LDAP Kerberos database can exploit this by supplying tagged data internal to the database module, causing a denial of service or bypassing a DN container check.

Recommendations For MIT krb5 versions 1.6 or later, consider restricting access to the kadmin functionality to prevent exploitation until a patch is available. As a temporary workaround, avoid using the database module with tagged data that is internal to it. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-2231

BDU:2019-01636

CESA-2018_3071

CVE-2018-5729

DLA-1643-1

DLA-2771-1

MGASA-2018-0155

OPENSUSE-SU-2019:0139-1

OPENSUSE-SU-2019_0139-1

OPENSUSE-SU-2024:10899-1

RHSA-2018:3071

RHSA-2018_3071

SUSE-SU-2018:0846-1

SUSE-SU-2018:0859-1

SUSE-SU-2018_0846-1

SUSE-SU-2019:0175-1

SUSE-SU-2019_0175-1

Affected Products

Alt Linux

Centos

Mit-Krb5

Red Hat

Suse

References · 67

• https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1 · Patch
• https://osv.dev/vulnerability/DLA-2771-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0155 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0859-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01636 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-5729 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-5729 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5729 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:0139-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1643-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0846-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-5729 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0327 · Vendor Advisory