CVE-2015-8630

The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name.

Affected Software

Name	Vendor	Start Version	End Version
Kerberos_5	Mit	1.12 (including)	1.12 (including)
Kerberos_5	Mit	1.12.1 (including)	1.12.1 (including)
Kerberos_5	Mit	1.12.2 (including)	1.12.2 (including)
Kerberos_5	Mit	1.12.3 (including)	1.12.3 (including)
Kerberos_5	Mit	1.12.4 (including)	1.12.4 (including)
Kerberos_5	Mit	1.12.5 (including)	1.12.5 (including)
Kerberos_5	Mit	1.13 (including)	1.13 (including)
Kerberos_5	Mit	1.13.1 (including)	1.13.1 (including)
Kerberos_5	Mit	1.13.2 (including)	1.13.2 (including)
Kerberos_5	Mit	1.13.3 (including)	1.13.3 (including)
Kerberos_5	Mit	1.14 (including)	1.14 (including)
Kerberos_5	Mit	1.14-alpha1 (including)	1.14-alpha1 (including)
Kerberos_5	Mit	1.14-beta1 (including)	1.14-beta1 (including)
Kerberos_5	Mit	1.14-beta2 (including)	1.14-beta2 (including)
Red Hat Enterprise Linux 7	RedHat	krb5-0:1.13.2-12.el7_2	*
Krb5	Ubuntu	esm-infra-legacy/trusty	*
Krb5	Ubuntu	trusty	*
Krb5	Ubuntu	trusty/esm	*
Krb5	Ubuntu	upstream	*
Krb5	Ubuntu	vivid	*
Krb5	Ubuntu	vivid/stable-phone-overlay	*
Krb5	Ubuntu	vivid/ubuntu-core	*
Krb5	Ubuntu	wily	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2015-8630
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References