| ID |
CVE-2014-5354
|
| Summary |
plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:a:mit:kerberos:5_1.13:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos:5_1.13:*:*:*:*:*:*:*
-
cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*
-
cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*
-
cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*
|
| CVSS |
| Base: | 3.5 (as of 21-01-2020 - 15:46) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
MEDIUM |
SINGLE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| NONE |
NONE |
PARTIAL |
|
| cvss-vector
via4
|
AV:N/AC:M/Au:S/C:N/I:N/A:P
|
| refmap
via4
|
|
| Last major update |
21-01-2020 - 15:46 |
| Published |
16-12-2014 - 23:59 |
| Last modified |
21-01-2020 - 15:46 |
