NetSight
IP …
medium5.3

CVE-2015-8629

The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether …

Impact

The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.

Affected products

VendorProductAffected versions
MitKerberos 5
before 1.13.4
from 1.14 before 1.14.1
OracleLinux
Versions 6, 7
OracleSolaris
Versions 10, 11.3
DebianDebian Linux
Versions 7.0, 8.0
OpensuseLeap
Version 42.1
OpensuseOpensuse
Version 13.2
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 6.7, 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.2, 7.3, 7.6, 7.7
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

Weakness classification

CWE-125

References