| Name | CVE-2014-5354 |
| Description | plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more) |
| NVD severity | low |
| Debian Bugs | 773228 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| krb5 (PTS) | stretch | 1.15-1+deb9u1 | fixed |
| stretch (security) | 1.15-1+deb9u2 | fixed | |
| buster | 1.17-3+deb10u1 | fixed | |
| buster (security) | 1.17-3+deb10u2 | fixed | |
| bullseye | 1.18.3-6 | fixed | |
| bookworm, sid | 1.18.3-7 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| krb5 | source | squeeze | (not affected) | |||
| krb5 | source | wheezy | (not affected) | |||
| krb5 | source | (unstable) | 1.12.1+dfsg-16 | 773228 |
[wheezy] - krb5 <not-affected> (do not expose a way for principal entries to have no long-term key material)
[squeeze] - krb5 <not-affected> (do not expose a way for principal entries to have no long-term key material)
Upstream commit: https://github.com/krb5/krb5/commit/04038bf3633c4b909b5ded3072dc88c8c419bf16