Vulnerability in Mit Kerberos 5
CVE-2012-1013
The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password.
EPSS: 0.031 (86.5th percentile) — read the EPSS interpretation.
Affected products
- Mit Kerberos_5 — versions 1.8, 1.8.1, 1.8.2
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Patch)
- cve@mitre.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2012-1013?
- CVE-2012-1013 is a vulnerability in Mit Kerberos 5. Published 2012-06-07.
- Is CVE-2012-1013 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.