CVE-2013-1417 — Improper Input Validation in Kerberos 5

CWE-20 — Improper Input ValidationCWE-476 — NULL Pointer Dereference8 documents7 sources
Severity
3.5LOWNVD
EPSS
0.5%
top 32.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MIT Krb5MIT Kerberos 5
Timeline
PublishedNov 20
Latest updateMay 13

Description

do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 6.8 | Impact: 2.9

Affected Packages2 packages

▶Debianmit/krb5< 1.11.3+dfsg-3+nmu1+3
▶NVDmit/kerberos_54 versions+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-wfgh-cf33-x6c3: do_tgs_req↗2022-05-13
▶
OSV
CVE-2013-1417: do_tgs_req↗2013-11-20
▶
CVEList
CVE-2013-1417: do_tgs_req↗2013-11-20
▶

📋Vendor Advisories

2
Red Hat
krb5: KDC null deref due to referrals↗2013-06-21
▶
Debian
CVE-2013-1417: krb5 - do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1...↗2013
▶

💬Community

2
Bugzilla
CVE-2013-1417 krb5: KDC null deref due to referrals [fedora-19]↗2013-11-15
▶
Bugzilla
CVE-2013-1417 krb5: KDC null deref due to referrals↗2013-11-15
▶