CVE-2015-2697: Medium severity kerberos vulnerability
The buildprincipalva function in lib/krb5/krb/bldprinc.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2697?
CVE-2015-2697 is classified as a denial of service vulnerability that affects certain versions of MIT Kerberos 5.
How do I fix CVE-2015-2697?
To fix CVE-2015-2697, upgrade to MIT Kerberos 5 version 1.14 or later.
What software is affected by CVE-2015-2697?
CVE-2015-2697 affects various operating systems including specific versions of MIT Kerberos 5, Oracle Solaris, Ubuntu Linux, Debian GNU/Linux, and openSUSE.
What type of attack does CVE-2015-2697 enable?
CVE-2015-2697 allows remote authenticated users to trigger a denial of service by causing an out-of-bounds read and KDC crash.
Is CVE-2015-2697 easy to exploit?
The exploitation of CVE-2015-2697 involves sending a TGS request with an initial '\0' character in the realm field, which requires some knowledge of the system configuration.