CVE-2018-5710 Null dereference in n/a

Medium 6.5 Published 16 Jan 2018 Updated 5 Aug 2024

Remote authenticated users can cause a denial of service in the Kerberos Key Distribution Center via a modified kadmin client triggering a NULL pointer dereference.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-5710?

CVE-2018-5710 is a medium-severity vulnerability in n/a, published on 16 Jan 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.

Weakness: CWE-476

Which versions are affected by CVE-2018-5710?

It affects 1 product.

Products include Mit Kerberos.

How do I fix CVE-2018-5710?

Apply the vendor's patch.

Is CVE-2018-5710 being exploited?

There is no known exploitation of CVE-2018-5710 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2018-5710, CLEANSTART-2024-HW06037, DEBIAN-CVE-2018-5710, GHSA-6wfw-m2q3-x7rq, UBUNTU-CVE-2018-5710.