CVE-2012-1013: Null Pointer Dereference
MIT Kerberos 5 version 1.10.2 was released [1] and noted as fixing:
Fix a kadmind denial of service issue (null pointer dereference), which could only be triggered by an administrator with the "create" privilege. [CVE-2012-1013]
No information is currently available on which versions are affected by this flaw.
[1] http://mailman.mit.edu/pipermail/kerberos-announce/2012q2/000136.html
Other sources
The check16dummy function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5KDBDISALLOWALLTIX create request that lacks a password.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1013?
CVE-2012-1013 is classified as a medium severity vulnerability due to its potential for causing a denial of service.
How do I fix CVE-2012-1013?
To fix CVE-2012-1013, you should upgrade to MIT Kerberos version 1.10.2 or later.
Which versions of MIT Kerberos are affected by CVE-2012-1013?
CVE-2012-1013 affects MIT Kerberos versions 1.8 through 1.10.1.
What type of attack does CVE-2012-1013 involve?
CVE-2012-1013 involves a denial of service attack that can be triggered by an administrator with create privileges.
Is user interaction required to exploit CVE-2012-1013?
Yes, exploiting CVE-2012-1013 requires interaction from an administrator with specific privileges.