CVE-2014-5354: Null Pointer Dereference
plugins/kdb/ldap/libkdbldap/ldapprincipal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "addprincipal -nokey" or "purgekeys -all" command.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5354?
CVE-2014-5354 has a medium severity level as it can cause a denial of service due to a null pointer dereference.
How do I fix CVE-2014-5354?
To fix CVE-2014-5354, upgrade to MIT Kerberos versions 1.13.1 or later or the appropriate Debian package versions listed in the remediation.
Who is affected by CVE-2014-5354?
Users of MIT Kerberos 5 versions 1.12.x and 1.13.x prior to 1.13.1 that use LDAP with a KDC are affected by CVE-2014-5354.
What can happen if I am affected by CVE-2014-5354?
If affected by CVE-2014-5354, a remote authenticated user can cause a daemon crash, resulting in service disruption.
Which versions of MIT Kerberos are vulnerable to CVE-2014-5354?
MIT Kerberos 5 versions 1.12 and 1.13 prior to 1.13.1 are vulnerable to CVE-2014-5354.