CVE-2013-1415: Null Pointer Dereference
The pkinitcheckkdcpkid function in plugins/preauth/pkinit/pkinitcryptoopenssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5PADATAPKASREQ AS-REQ request.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1415?
CVE-2013-1415 is classified as a moderate severity vulnerability.
How do I fix CVE-2013-1415?
To fix CVE-2013-1415, upgrade MIT Kerberos 5 to version 1.10.4 or later, or 1.11.1 or later.
What software is affected by CVE-2013-1415?
CVE-2013-1415 affects MIT Kerberos 5 versions prior to 1.10.4 and various 1.11.x versions before 1.11.1.
What is the nature of the vulnerability in CVE-2013-1415?
The vulnerability in CVE-2013-1415 is related to improper error handling during the extraction of fields from X.509 certificates.
Is there a workaround for CVE-2013-1415?
There are no known workarounds for CVE-2013-1415; updating to a secure version is recommended.