CVE-2011-0285

2011-04-1500:55:00

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

High

EPSS

0.246

Percentile

96.7%

JSON

The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.

Affected configurations

Nvd

Node

mitkerberos_5Match1.7

mitkerberos_5Match1.7.1

mitkerberos_5Match1.8

mitkerberos_5Match1.8.1

mitkerberos_5Match1.8.2

mitkerberos_5Match1.8.3

mitkerberos_5Match1.9

VendorProductVersionCPE
mitkerberos_51.7cpe:2.3:a:mit:kerberos_5:1.7:*:*:*:*:*:*:*
mitkerberos_51.7.1cpe:2.3:a:mit:kerberos_5:1.7.1:*:*:*:*:*:*:*
mitkerberos_51.8cpe:2.3:a:mit:kerberos_5:1.8:*:*:*:*:*:*:*
mitkerberos_51.8.1cpe:2.3:a:mit:kerberos_5:1.8.1:*:*:*:*:*:*:*
mitkerberos_51.8.2cpe:2.3:a:mit:kerberos_5:1.8.2:*:*:*:*:*:*:*
mitkerberos_51.8.3cpe:2.3:a:mit:kerberos_5:1.8.3:*:*:*:*:*:*:*
mitkerberos_51.9cpe:2.3:a:mit:kerberos_5:1.9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mit	kerberos_5	1.7	cpe:2.3:a:mit:kerberos_5:1.7:::::::*
mit	kerberos_5	1.7.1	cpe:2.3:a:mit:kerberos_5:1.7.1:::::::*
mit	kerberos_5	1.8	cpe:2.3:a:mit:kerberos_5:1.8:::::::*
mit	kerberos_5	1.8.1	cpe:2.3:a:mit:kerberos_5:1.8.1:::::::*
mit	kerberos_5	1.8.2	cpe:2.3:a:mit:kerberos_5:1.8.2:::::::*
mit	kerberos_5	1.8.3	cpe:2.3:a:mit:kerberos_5:1.8.3:::::::*
mit	kerberos_5	1.9	cpe:2.3:a:mit:kerberos_5:1.9:::::::*