CVE-2016-3120 — NULL Pointer Dereference in Kerberos 5

CWE-476 — NULL Pointer Dereference8 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
3.3%
top 12.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MIT Krb5MIT Kerberos 5
Timeline
PublishedAug 1
Latest updateMay 13

Description

The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Debianmit/krb5< 1.14.3+dfsg-1+3
▶NVDmit/kerberos_510 versions+9

🔴Vulnerability Details

3
GHSA
GHSA-8q8p-vxj6-fg2g: The validate_as_request function in kdc_util↗2022-05-13
▶
OSV
CVE-2016-3120: The validate_as_request function in kdc_util↗2016-08-01
▶
CVEList
CVE-2016-3120: The validate_as_request function in kdc_util↗2016-08-01
▶

📋Vendor Advisories

2
Red Hat
krb5: S4U2Self KDC crash when anon is restricted↗2016-07-19
▶
Debian
CVE-2016-3120: krb5 - The validate_as_request function in kdc_util.c in the Key Distribution Center (K...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-3120 krb5: S4U2Self KDC crash when anon is restricted↗2016-07-28
▶
Bugzilla
CVE-2016-3120 krb5: S4U2Self KDC crash when anon is restricted [fedora-all]↗2016-07-28
▶
CVE-2016-3120 — NULL Pointer Dereference in Kerberos 5 | cvebase