CVE-2015-2696

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 09-11-2015 04:59

Last modified: - 19-10-2022 04:59

Total changes: - 3

Description

lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:M/Au:N/C:N/I:N/A:C

Low

Attack complexity

Network

Attack vector

High

Availability

None

Confidentiality

None

Integrity

Privileges required

Scope

User interaction

7.1

Base score

8.6

6.9

Exploitability score

Impact score

Verification logic

Reference

http://krbdev.mit.edu/rt/Ticket/Display.html?id=8244
https://github.com/krb5/krb5/commit/e04f0283516e80d2f93366e0d479d13c9b5c8c2a
90675-Third Party Advisory, VDB Entry
openSUSE-SU-2015:1997-Mailing List, Third Party Advisory
openSUSE-SU-2015:1928-Mailing List, Third Party Advisory
SUSE-SU-2015:1897-Mailing List, Third Party Advisory
USN-2810-1-Third Party Advisory
DSA-3395-Third Party Advisory
1034084-Third Party Advisory, VDB Entry
GLSA-201611-14-Third Party Advisory

Keywords

CVE-2015-2696

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2015-2696

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures