CVE-2013-6800
krb5: KDC remote DoS (NULL pointer dereference and daemon crash)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request, a different vulnerability than CVE-2013-1418.
Un módulo de base de datos de terceros sin especificar para Key Distribution Center (KDC) en MIT Kerberos 5 (también conocido como krb5) 1.10.x permite a usuarios remotos autenticados provocar una denegación de servicio (referencia a puntero NULL y cierre del demonio) a través de una petición manipulada, una vulnerabilidad diferente a CVE-2013-1418.
It was found that if a KDC served multiple realms, certain requests could cause the setup_server_realm() function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request.
Kerberos is an authentication system which allows clients and services to authenticate to each other with the help of a trusted third party, a Kerberos Key Distribution Center. It was found that if a KDC served multiple realms, certain requests could cause the setup_server_realm() function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request. A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. A remote, unauthenticated attacker could use this flaw to crash a GSSAPI-enabled server application.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-11-15 CVE Reserved
- 2013-11-16 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://krbdev.mit.edu/rt/Ticket/Display.html?id=7757 | X_refsource_confirm | |
| http://www.securityfocus.com/bid/63770 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/krb5/krb5/commit/c2ccf4197f697c4ff143b8a786acdd875e70a89d | 2020-01-21 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2013-6800 | 2014-10-13 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1031499 | 2014-10-13 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mit Search vendor "Mit" | Kerberos Search vendor "Mit" for product "Kerberos" | 5-1.10.5 Search vendor "Mit" for product "Kerberos" and version "5-1.10.5" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos Search vendor "Mit" for product "Kerberos" | 5-1.10.6 Search vendor "Mit" for product "Kerberos" and version "5-1.10.6" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos Search vendor "Mit" for product "Kerberos" | 5-1.10.7 Search vendor "Mit" for product "Kerberos" and version "5-1.10.7" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.10 Search vendor "Mit" for product "Kerberos 5" and version "1.10" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.10.1 Search vendor "Mit" for product "Kerberos 5" and version "1.10.1" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.10.2 Search vendor "Mit" for product "Kerberos 5" and version "1.10.2" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.10.3 Search vendor "Mit" for product "Kerberos 5" and version "1.10.3" | - |
Affected
| ||||||
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | 1.10.4 Search vendor "Mit" for product "Kerberos 5" and version "1.10.4" | - |
Affected
| ||||||