CVE-2015-2694

2015-05-2519:59:02

CWE-264

[email protected]

web.nvd.nist.gov

cve-2015-2694

mit kerberos 5

krb5

kdcpreauth modules

preauthentication bypass

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

7.4

Confidence

High

EPSS

0.004

Percentile

74.6%

JSON

The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client’s request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.

Affected configurations

NVD

Node

mitkerberos_5Match1.12

mitkerberos_5Match1.12.1

mitkerberos_5Match1.12.2

mitkerberos_5Match1.12.3

mitkerberos_5Match1.13

mitkerberos_5Match1.13.1

VendorProductVersionCPE
mitkerberos_51.12.1cpe:/a:mit:kerberos_5:1.12.1:::
mitkerberos_51.12.3cpe:/a:mit:kerberos_5:1.12.3:::
mitkerberos_51.12cpe:/a:mit:kerberos_5:1.12:::
mitkerberos_51.13.1cpe:/a:mit:kerberos_5:1.13.1:::
mitkerberos_51.13cpe:/a:mit:kerberos_5:1.13:::
mitkerberos_51.12.2cpe:/a:mit:kerberos_5:1.12.2:::

Vendor	Product	Version	CPE
mit	kerberos_5	1.12.1	cpe:/a:mit:kerberos_5:1.12.1:::
mit	kerberos_5	1.12.3	cpe:/a:mit:kerberos_5:1.12.3:::
mit	kerberos_5	1.12	cpe:/a:mit:kerberos_5:1.12:::
mit	kerberos_5	1.13.1	cpe:/a:mit:kerberos_5:1.13.1:::
mit	kerberos_5	1.13	cpe:/a:mit:kerberos_5:1.13:::
mit	kerberos_5	1.12.2	cpe:/a:mit:kerberos_5:1.12.2:::