CVE-2011-1527 Null dereference in n/a
Remote attackers can crash the Kerberos KDC daemon via a crafted kinit request when the LDAP backend is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1527?
CVE-2011-1527 is a high-severity vulnerability in Mit Kerberos 5, published on 20 Oct 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The kdb_ldap plugin in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a kinit operation with incorrect string case for the realm, related to the is_principal_in_realm, krb5_set_error_message, krb5_ldap_get_principal, and process_as_req functions.
Weakness: CWE-20
Which versions are affected by CVE-2011-1527?
It affects 1 product.
Products include Mit Kerberos 5.
How do I fix CVE-2011-1527?
Apply the vendor's patch.
Is CVE-2011-1527 being exploited?
There is no known exploitation of CVE-2011-1527 in the wild and no public exploit code.
Other vulnerabilities in Mit Kerberos 5
Sources
Also known as DEBIAN-CVE-2011-1527, GHSA-848m-2rw5-f2f2.