Authorization

2015-02-1911:59:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

6.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:P/I:P/A:C

0.008 Low

EPSS

Percentile

81.4%

JSON

The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial “kadmind” substring, as demonstrated by a “ka/x” principal.

CPENameOperatorVersion
kerberos_5eq1.11
kerberos_5eq1.11.1
kerberos_5eq1.11.2
kerberos_5eq1.11.3
kerberos_5eq1.11.4
kerberos_5eq1.11.5
kerberos_5eq1.12
kerberos_5eq1.12.1
kerberos_5eq1.12.2
kerberos_5eq1.13

Name	Operator	Version
kerberos_5	eq	1.11
kerberos_5	eq	1.11.1
kerberos_5	eq	1.11.2
kerberos_5	eq	1.11.3
kerberos_5	eq	1.11.4
kerberos_5	eq	1.11.5
kerberos_5	eq	1.12
kerberos_5	eq	1.12.1
kerberos_5	eq	1.12.2
kerberos_5	eq	1.13