CVE-2012-1014 — Kerberos 5 vulnerability

9 documents8 sources
Severity
9.0CRITICALNVD
EPSS
4.2%
top 11.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MIT Krb5MIT Kerberos 5
Timeline
PublishedAug 6
Latest updateMay 13

Description

The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a malformed AS-REQ request.

CVSS vector

AV:N/AC:L/C:P/I:P/A:CExploitability: 10.0 | Impact: 8.5

Affected Packages2 packages

▶Debianmit/krb5< 1.10.1+dfsg-2+3
▶NVDmit/kerberos_51.10, 1.10.1, 1.10.2+2

Patches

Patch: web.mit.edu ↗Patch: web.mit.edu ↗

🔴Vulnerability Details

3
GHSA
GHSA-4x54-5wgw-wc8c: The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1↗2022-05-13
▶
CVEList
CVE-2012-1014: The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1↗2012-08-06
▶
OSV
CVE-2012-1014: The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1↗2012-08-06
▶

📋Vendor Advisories

3
Red Hat
krb5: KDC daemon crash via de-reference of an uninitialized pointer↗2012-07-31
▶
Ubuntu
Kerberos vulnerabilities↗2012-07-31
▶
Debian
CVE-2012-1014: krb5 - The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos...↗2012
▶

💬Community

2
Bugzilla
CVE-2012-1014 krb5: KDC daemon crash via de-reference of an uninitialized pointer [fedora-17]↗2012-07-31
▶
Bugzilla
CVE-2012-1014 krb5: KDC daemon crash via de-reference of an uninitialized pointer↗2012-07-06
▶
CVE-2012-1014 — MIT Kerberos 5 vulnerability | cvebase