CVE-2013-4132

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw_encrypt functions, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via (1) an invalid salt or a (2) DES or (3) MD5 encrypted password, when FIPS-140 is enable, to KDM or an (4) invalid password to KCheckPass.

KDE-Workspace 4.10.5 y anteriores no gestiona de forma adecuada el valor de retorno de glibc 2.17 crypt y funciones pw_encrypt, lo que permite a atacantes remotos provocar una denegación de servicio
(referencia a puntero nulo y cuelgue) a través de (1) un "salt" invalido o una contraseña cifrada, cuando FIPS-140 está habilitado, para KDM o una (4) contraseña no válida para KCheckPass.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-06-12 CVE Reserved
2013-09-16 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-310: Cryptographic Issues

CAPEC

References (5)

URL	Tag	Source
http://seclists.org/oss-sec/2013/q3/117	Mailing List
http://seclists.org/oss-sec/2013/q3/120	Mailing List
https://git.reviewboard.kde.org/r/111261	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-updates/2013-07/msg00082.html	2018-10-30
http://lists.opensuse.org/opensuse-updates/2013-08/msg00002.html	2018-10-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Kde Search vendor "Kde"		Kde-workspace Search vendor "Kde" for product "Kde-workspace"				<= 4.10.5 Search vendor "Kde" for product "Kde-workspace" and version " <= 4.10.5"		-		Affected
Kde Search vendor "Kde"		Kde Sc Search vendor "Kde" for product "Kde Sc"				<= 4.10.5 Search vendor "Kde" for product "Kde Sc" and version " <= 4.10.5"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				12.2 Search vendor "Opensuse" for product "Opensuse" and version "12.2"		-		Affected