Vulnerability CVE-2018-5730


Published: 2018-03-06

Description:
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.

Type:

CWE-90

(Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))

Vendor: Debian
Product: Debian linux 
Version: 8.0;
Vendor: Redhat
Product: Enterprise linux server 
Version: 7.0;
Product: Enterprise linux desktop 
Version: 7.0;
Product: Enterprise linux workstation 
Version: 7.0;
Vendor: MIT
Product: Kerberos 
Version:
5_1.3.3
5_1.2
5_1.1.1
5_1.1
5_1.0.6
5_1.0
5-1.9.4
5-1.9.3
5-1.9.2
5-1.9.1
5-1.9
5-1.8.6
5-1.8.5
5-1.8.4
5-1.8.3
5-1.8.2
5-1.8.1
5-1.8
5-1.7.1
5-1.7
5-1.6.2
5-1.6.1
5-1.6
5-1.17
5-1.15.1
5-1.15
5-1.14.5
5-1.14.4
5-1.14.3
5-1.14.2
5-1.14
5-1.13.6
5-1.13.5
5-1.13.3
5-1.13.2
5-1.13.1
5-1.13
5-1.12.3
5-1.12.2
5-1.12.1
5-1.12
5-1.11.5
5-1.11.4
5-1.11.3
5-1.11.2
5-1.11.1
5-1.11
5-1.10.4
5-1.10.3
5-1.10.2
5-1.10.1
5-1.10
Vendor: Fedoraproject
Product: Fedora 
Version: 27; 26;

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.5/10
4.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None

 References:
http://www.securitytracker.com/id/1042071
https://access.redhat.com/errata/RHBA-2019:0327
https://access.redhat.com/errata/RHSA-2018:3071
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869
https://bugzilla.redhat.com/show_bug.cgi?id=1551082
https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1
https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/

Related CVE
CVE-2019-16910
Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the...
CVE-2019-14844
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC.
CVE-2019-16239
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
CVE-2019-15718
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivile...
CVE-2019-11500
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
CVE-2019-9852
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Script...
CVE-2019-9851
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calli...
CVE-2019-9850
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify tha...

Copyright 2019, cxsecurity.com

 

Back to Top