CVE-2018-5729
published 2018-03-06CVE-2018-5729: MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer…
PriorityP423medium4.7CVSS 3.1
AVNACLPRHUINSUCLILAL
EPSS
2.58%
85.1th percentile
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | krb5 | < krb5 1.16.1-1 (bookworm) | krb5 1.16.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mit | kerberos_5 | >= 5-1.6 < 5-1.21.2 | 5-1.21.2 |
| mit | krb5 | >= 0 < 1.16.1-1 | 1.16.1-1 |
| mit | krb5 | >= 0 < 1.16.1-1 | 1.16.1-1 |
| mit | krb5 | >= 0 < 1.16.1-1 | 1.16.1-1 |
| mit | krb5 | >= 0 < 1.16.1-1 | 1.16.1-1 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv4.7MEDIUM
vendor_redhat6.5MEDIUM
vendor_debian4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
vendor_redhat·2018-03-01·CVSS 4.7
CVE-2018-5729 [MEDIUM] CWE-90 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.
Package: krb5 (Red Hat Enterprise Linux 5) - Will not fix
Package: krb5 (Red Hat Enterprise Linux 6) - Will not fix
Package: krb5 (Red Hat Enterprise Linux 8) - Not affected
Package: krb5 (Red Hat JBoss Core Services) - Will not fix
Package: krb5 (Red Hat JBoss Enterprise Application Platform 6) - Will not fix
Package: krb5 (Red Hat JBoss Enterprise Web Server 2) - Will not fix
Red Hat
krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
vendor_redhat·2018-01-15·CVSS 6.5
CVE-2018-5710 [MEDIUM] CWE-476 krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.
Statement: This flaw was found to be a duplicate of CVE-2018-5729. Please see https://access.redhat.com/security/cve/CVE-2018-5729 for information about affected products and security errata.
Package: krb5 (Red Hat Enterprise Linux 5) - Not affected
Package: krb5 (Red Hat Enterprise Linux 6) - Not affected
Package: krb5 (Red Hat Ent
Debian
CVE-2018-5729: krb5 - MIT krb5 1.6 or later allows an authenticated kadmin with permission to add prin...
vendor_debian·2018·CVSS 4.7
CVE-2018-5729 [MEDIUM] CVE-2018-5729: krb5 - MIT krb5 1.6 or later allows an authenticated kadmin with permission to add prin...
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.
Scope: local
bookworm: resolved (fixed in 1.16.1-1)
bullseye: resolved (fixed in 1.16.1-1)
forky: resolved (fixed in 1.16.1-1)
sid: resolved (fixed in 1.16.1-1)
trixie: resolved (fixed in 1.16.1-1)
GHSA
GHSA-c28w-559x-wr7v: MIT krb5 1
ghsa_unreviewed·2022-05-13
CVE-2018-5729 [MEDIUM] CWE-476 GHSA-c28w-559x-wr7v: MIT krb5 1
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.
OSV
CVE-2018-5729: MIT krb5 1
osv·2018-03-06·CVSS 4.7
CVE-2018-5729 [MEDIUM] CVE-2018-5729: MIT krb5 1
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-5729 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data [fedora-all]
bugzilla·2018-03-02·CVSS 4.7
CVE-2018-5729 [MEDIUM] CVE-2018-5729 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data [fedora-all]
CVE-2018-5729 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE:
Bugzilla
CVE-2018-5729 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
bugzilla·2018-03-02·CVSS 4.7
CVE-2018-5729 [MEDIUM] CVE-2018-5729 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
CVE-2018-5729 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can cause a null dereference in kadmind, or circumvent a DN container check, by supplying tagged data intended to be internal to the database module.
Reference:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869
Upstream patch:
https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1
Discussion:
Created krb5 tracking bugs for this issue:
Affects: fedora-all [bug 1551084]
---
This is identical to https://bugzilla.redhat.com/show_bug.cgi?id=1535575
---
This issue has been addressed in the following products:
Red
Bugzilla
CVE-2018-5710 krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
bugzilla·2018-01-17·CVSS 6.5
CVE-2018-5710 [MEDIUM] CVE-2018-5710 krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
CVE-2018-5710 krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.
References:
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29
Discussion:
Created krb5 tracking bugs for this issue:
Affects: fedora-all [bug 1535576]
---
Statement:
This flaw was found to be a duplicate of CVE-2018-5729. Please see https://access.redhat.com/sec
Bugzilla
CVE-2018-5729, CVE-2018-5730 krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c [fedora-all]
bugzilla·2018-01-17·CVSS 4.7
CVE-2018-5729 [MEDIUM] CVE-2018-5729, CVE-2018-5730 krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c [fedora-all]
CVE-2018-5729, CVE-2018-5730 krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit
http://www.securitytracker.com/id/1042071https://access.redhat.com/errata/RHBA-2019:0327https://access.redhat.com/errata/RHSA-2018:3071https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869https://bugzilla.redhat.com/show_bug.cgi?id=1551083https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1https://lists.debian.org/debian-lts-announce/2019/01/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2021/09/msg00019.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/http://www.securitytracker.com/id/1042071https://access.redhat.com/errata/RHBA-2019:0327https://access.redhat.com/errata/RHSA-2018:3071https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869https://bugzilla.redhat.com/show_bug.cgi?id=1551083https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1https://lists.debian.org/debian-lts-announce/2019/01/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2021/09/msg00019.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/
2018-03-06
Published