CVE-2011-1529

2011-10-2021:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2011-1529

mit kerberos

krb5

denial of service

remote attackers

null pointer dereference

daemon crash

process_as_req errors

6 Medium

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.738 High

EPSS

Percentile

98.1%

JSON

The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.

CPENameOperatorVersion
mit:kerberos_5mit kerberos 5eq1.8
mit:kerberos_5mit kerberos 5eq1.8.1
mit:kerberos_5mit kerberos 5eq1.8.2
mit:kerberos_5mit kerberos 5eq1.8.3
mit:kerberos_5mit kerberos 5eq1.8.4
mit:kerberos_5mit kerberos 5eq1.9
mit:kerberos_5mit kerberos 5eq1.9.1

CPE	Name	Operator	Version
mit:kerberos_5	mit kerberos 5	eq	1.8
mit:kerberos_5	mit kerberos 5	eq	1.8.1
mit:kerberos_5	mit kerberos 5	eq	1.8.2
mit:kerberos_5	mit kerberos 5	eq	1.8.3
mit:kerberos_5	mit kerberos 5	eq	1.8.4
mit:kerberos_5	mit kerberos 5	eq	1.9
mit:kerberos_5	mit kerberos 5	eq	1.9.1