CVE-2015-8629
Medium
Description
The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Mit Kerberos
PublishedFeb 13, 2016
First seenFeb 13, 2016
How to fix
Update
- mit kerberos_51.13.4, 1.14.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos_5 | v < 1.13.4, 1.14 ≤ v < 1.14.1 | 1.13.4, 1.14.1 |
| oracle linux | 6, 7 | — |
| oracle solaris | 10, 11.3 | — |
| debian debian_linux | 7.0, 8.0 | — |
| opensuse leap | 42.1 | — |
| opensuse opensuse | 13.2 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_eus | 6.7, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.2, 7.3, 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_server_tus | 7.2, 7.3, 7.6, 7.7 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.