NetSight
IP …
low3.5

CVE-2014-5353

The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC u…

Impact

The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

Affected products

VendorProductAffected versions
MitKerberos 5
before 1.13.1
RedhatEnterprise Linux Desktop
Version 6.0
RedhatEnterprise Linux Eus
Versions 6.6, 7.3, 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 6.6, 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 6.6, 7.3, 7.6, 7.7
RedhatEnterprise Linux Workstation
Version 6.0
FedoraprojectFedora
Version 22
DebianDebian Linux
Version 7.0
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10
OracleSolaris
Versions 10, 11.2
OpensuseOpensuse
Versions 13.1, 13.2

Weakness classification

CWE-476

References