CVE-2011-1529 Null dereference in n/a
Remote attackers can crash the Kerberos KDC daemon via a null pointer dereference when using specific database backends.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1529?
CVE-2011-1529 is a high-severity vulnerability in Mit Kerberos 5, published on 20 Oct 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.
Weakness: CWE-20
Which versions are affected by CVE-2011-1529?
It affects 1 product.
Products include Mit Kerberos 5.
How do I fix CVE-2011-1529?
Upgrade to a fixed version.
Is CVE-2011-1529 being exploited?
There is no known exploitation of CVE-2011-1529 in the wild and no public exploit code.
Other vulnerabilities in Mit Kerberos 5
Sources
Also known as DEBIAN-CVE-2011-1529, GHSA-54mf-f57f-83fj.