Back to Database
Status published
Medium
CVE-2015-2697
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka...
Vulnerability Description
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-2697
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/krb5/krb5/commit/f0c094a1b745d91ef2f9a4eae2149aac026a5789
- http://www.securityfocus.com/bid/77581
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00006.html
- https://security.gentoo.org/glsa/201611-14
- http://www.securitytracker.com/id/1034084
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00014.html
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=8252
- http://www.debian.org/security/2015/dsa-3395
- http://www.ubuntu.com/usn/USN-2810-1
More from mit
View All →CVE-2022-42898
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4...
Unknown
0
CVE-2021-37750
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka...
Medium
6.5
CVE-2021-36222
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in...
High
7.5
CVE-2021-32471
Insufficient input validation in the Marvin Minsky 1967 implementation of...
High
7.8
CVE-2020-28196
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before...
Unknown
0
Affected Vendor
Affected Software
kerberos 5, solaris, ubuntu linux, debian linux, leap, opensuse, linux enterprise desktop, linux enterprise server, linux enterprise software development kit
Vulnerable Versions:
0, 11.3, 12.04, 14.04, 15.04, 15.10, 7.0, 8.0, 9.0, 42.1, 13.1, 13.2, 12
Timeline
Official Publish:
November 9th, 2015
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.