Design/Logic Flaw

2014-12-1623:59:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

74.3%

JSON

The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

CPENameOperatorVersion
ubuntu_linuxeq14.10
ubuntu_linuxeq14.04
ubuntu_linuxeq10.04
ubuntu_linuxeq12.04
debian_linuxeq7.0
fedoraeq22
kerberos_5lt1.13.1
opensuseeq13.1
opensuseeq13.2
solariseq11.2

Name	Operator	Version
ubuntu_linux	eq	14.10
ubuntu_linux	eq	14.04
ubuntu_linux	eq	10.04
ubuntu_linux	eq	12.04
debian_linux	eq	7.0
fedora	eq	22
kerberos_5	lt	1.13.1
opensuse	eq	13.1
opensuse	eq	13.2
solaris	eq	11.2