CVE-2012-1014: Critical severity MIT Kerberos 5 vulnerability
The processasreq function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a malformed AS-REQ request.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability severity of CVE-2012-1014?
CVE-2012-1014 has been rated as a medium severity vulnerability due to its potential to cause denial of service and possibly arbitrary code execution.
How do I fix CVE-2012-1014?
To fix CVE-2012-1014, upgrade to MIT Kerberos 5 version 1.10.3 or later to ensure the vulnerable code is patched.
What versions of MIT Kerberos 5 are affected by CVE-2012-1014?
CVE-2012-1014 affects MIT Kerberos 5 versions 1.10, 1.10.1, and 1.10.2.
What type of attack can CVE-2012-1014 facilitate?
CVE-2012-1014 can facilitate denial of service attacks through uninitialized pointer dereference, which may cause the KDC daemon to crash.
Is remote exploitation possible with CVE-2012-1014?
Yes, CVE-2012-1014 allows remote attackers to exploit the vulnerability, leading to a denial of service or potential remote code execution.