SB2014121702 - Input validation error in web.mit.edu krb5
Published: December 17, 2014 Updated: July 28, 2020
Security Bulletin ID
SB2014121702
CSH Severity
Low
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Input validation error (CVE-ID: CVE-2014-5353)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows remote authenticated users to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.
References
- http://advisories.mageia.org/MGASA-2014-0536.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html
- http://rhn.redhat.com/errata/RHSA-2015-0439.html
- http://rhn.redhat.com/errata/RHSA-2015-0794.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:009
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/71679
- http://www.securitytracker.com/id/1031376
- http://www.ubuntu.com/usn/USN-2498-1
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226
- https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3
- https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html