CVE-2015-8630 Null dereference in n/a

What is CVE-2015-8630?

CVE-2015-8630 is a high-severity vulnerability in Mit Kerberos 5, published on 13 Feb 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name.

Which versions are affected by CVE-2015-8630?

It affects 1 product.

Products include Mit Kerberos 5.

How do I fix CVE-2015-8630?

Upgrade to a fixed version.

Is CVE-2015-8630 being exploited?

There is no known exploitation of CVE-2015-8630 in the wild and no public exploit code.

Other vulnerabilities in Mit Kerberos 5

• CVE-2011-0285 Use after free in n/a Critical 10.0
• CVE-2008-0947 Memory corruption in n/a Critical 10.0
• CVE-2007-5902 Integer overflow in n/a Critical 10.0
• CVE-2007-4743 Memory corruption in n/a Critical 10.0
• CVE-2007-3999 Memory corruption in n/a Critical 10.0

All Mit Kerberos 5 vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2015-8630, DEBIAN-CVE-2015-8630, GHSA-ccgj-jmwf-5p3g, UBUNTU-CVE-2015-8630.