CVE-2011-1528 — Improper Input Validation in Kerberos 5

CWE-20 — Improper Input Validation9 documents8 sources
Severity
7.8HIGHNVD
EPSS
5.5%
top 9.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MIT Krb5MIT Kerberos 5
Timeline
PublishedOct 20
Latest updateMay 13

Description

The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, related to the locked_check_p function. NOTE: the Berkeley DB vector is covered by CVE-2011-4151.

CVSS vector

AV:N/AC:L/C:N/I:N/A:CExploitability: 10.0 | Impact: 6.9

Affected Packages2 packages

▶Debianmit/krb5< 1.10+dfsg~alpha1-1+3
▶NVDmit/kerberos_57 versions+6

🔴Vulnerability Details

3
GHSA
GHSA-hxvv-vjx9-wj2m: The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1↗2022-05-13
▶
CVEList
CVE-2011-1528: The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1↗2011-10-20
▶
OSV
CVE-2011-1528: The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1↗2011-10-20
▶

📋Vendor Advisories

4
Ubuntu
Kerberos Vulnerabilities↗2011-10-18
▶
Red Hat
krb5: KDC denial of service vulnerabilities (MITKRB5-SA-2011-006)↗2011-10-18
▶
Red Hat
krb5: KDC denial of service vulnerabilities (MITKRB5-SA-2011-006)↗2011-10-18
▶
Debian
CVE-2011-1528: krb5 - The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT...↗2011
▶

💬Community

1
Bugzilla
CVE-2011-1527 CVE-2011-1528 CVE-2011-1529 CVE-2011-4151 krb5: KDC denial of service vulnerabilities (MITKRB5-SA-2011-006)↗2011-09-12
▶
CVE-2011-1528 — Improper Input Validation in Kerberos 5 | cvebase