Input validation error in Kerberos 5 - CVE-2014-5353
Published: December 17, 2014 / Updated: July 28, 2020
Vulnerability identifier: #VU32452
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-5353
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows remote authenticated users to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.
Affected software
Kerberos 5
Amazon Linux AMI
Fedora
krb5 (Alpine package)
krb5
Amazon Linux AMI
Fedora
krb5 (Alpine package)
krb5
How to mitigate CVE-2014-5353
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
krb5 (Alpine package) - update to 1.13-r1
krb5 - addressed in versions 1.12.2-16.fc21, 1.12.2-17.fc21, 1.13.1-2.fc22
krb5 - addressed in versions 1.12.2-16.fc21, 1.12.2-17.fc21, 1.13.1-2.fc22
External References
- http://advisories.mageia.org/MGASA-2014-0536.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html
- http://rhn.redhat.com/errata/RHSA-2015-0439.html
- http://rhn.redhat.com/errata/RHSA-2015-0794.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:009
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/71679
- http://www.securitytracker.com/id/1031376
- http://www.ubuntu.com/usn/USN-2498-1
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226
- https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3
- https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html