CVE-2015-2694 — Kerberos 5 vulnerability

CWE-2649 documents8 sources
Severity
5.8MEDIUMNVD
EPSS
0.9%
top 24.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MIT Krb5MIT Kerberos 5
Timeline
PublishedMay 25
Latest updateMay 13

Description

The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages2 packages

▶Debianmit/krb5< 1.12.1+dfsg-20+3
▶NVDmit/kerberos_56 versions+5

🔴Vulnerability Details

3
GHSA
GHSA-6h2g-5cjr-jj97: The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1↗2022-05-13
▶
OSV
CVE-2015-2694: The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1↗2015-05-25
▶
CVEList
CVE-2015-2694: The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1↗2015-05-25
▶

📋Vendor Advisories

3
Ubuntu
Kerberos vulnerabilities↗2015-11-12
▶
Red Hat
krb5: issues in OTP and PKINIT kdcpreauth modules leading to requires_preauth bypass↗2015-04-27
▶
Debian
CVE-2015-2694: krb5 - The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.1...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-2694 krb5: issues in OTP and PKINIT kdcpreauth modules leading to requires_preauth bypass↗2015-04-28
▶
Bugzilla
CVE-2015-2694 krb5: issues in OTP and PKINIT kdcpreauth modules leading to requires_preauth bypass [fedora-21]↗2015-04-28
▶
CVE-2015-2694 — MIT Kerberos 5 vulnerability | cvebase