CVE-2014-9422: Medium severity MIT Kerberos 5 vulnerability
The checkrpcsecauth function in kadmin/server/kadmrpcsvc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/ authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9422?
CVE-2014-9422 has been assigned a CVSS score indicating a high severity due to the potential for privileged escalation.
How do I fix CVE-2014-9422?
To fix CVE-2014-9422, you should upgrade to a patched version of MIT Kerberos 5, specifically 1.13.1 or later.
What types of users can exploit CVE-2014-9422?
CVE-2014-9422 can be exploited by remote authenticated users who gain unauthorized access to administrative functions.
Which versions of MIT Kerberos 5 are vulnerable to CVE-2014-9422?
MIT Kerberos 5 versions 1.11 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 are vulnerable to CVE-2014-9422.
What are the potential impacts of CVE-2014-9422?
The potential impacts of CVE-2014-9422 include unauthorized administrative access which can compromise system integrity and security.