CVE-2014-5353

Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 16 Dec 2014, 23:00
Last modified:06 Aug 2024, 11:41

Vulnerability Summary

Overall Risk (default)
low
14/100
CVSS Score
3.5 LOW
v2.0 (nvd)
EPSS Score
0.55% LOW
1% probability -0.32%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

16 Dec 2014, 23:00
Published
Vulnerability first disclosed
06 Aug 2024, 11:41
Last Modified
Vulnerability information updated

Description

The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

CVSS Metrics

  • v2.0•LOW•Score: 3.5AV:N/AC:M/Au:S/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.55%• Percentile: 68%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • canonical•ubuntu_linux

    10.04 | 12.04 | 14.04 | 14.10

  • debian•debian_linux

    7.0

  • fedoraproject•fedora

    22

  • mit•kerberos_5

    < 1.13.1

  • opensuse•opensuse

    13.1 | 13.2

  • Unknown•Solaris

    10 | 11.2

  • redhat•enterprise_linux_desktop

    6.0

  • redhat•enterprise_linux_eus

    6.6 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7

  • redhat•enterprise_linux_server

    6.0 | 7.0

  • redhat•enterprise_linux_server_aus

    6.6 | 7.3 | 7.4 | 7.6 | 7.7

  • redhat•enterprise_linux_server_tus

    6.6 | 7.3 | 7.6 | 7.7

  • redhat•enterprise_linux_workstation

    6.0

References (13)