CVE-2014-5354

Name	CVE-2014-5354
Description	plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	low (attack range: remote)
Debian Bugs	773228

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
krb5 (PTS)	jessie	1.12.1+dfsg-19+deb8u4	fixed
	jessie (security)	1.12.1+dfsg-19+deb8u5	fixed
	stretch	1.15-1+deb9u1	fixed
	buster, sid	1.17-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
krb5	source	(unstable)	1.12.1+dfsg-16	low	773228
krb5	source	squeeze	(not affected)
krb5	source	wheezy	(not affected)

Notes

[wheezy] - krb5 <not-affected> (do not expose a way for principal entries to have no long-term key material)
[squeeze] - krb5 <not-affected> (do not expose a way for principal entries to have no long-term key material)
Upstream commit: https://github.com/krb5/krb5/commit/04038bf3633c4b909b5ded3072dc88c8c419bf16