« Volver al listado

CVE-2013-4132

Estado: ModificadaMedia (5)—

KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw_encrypt functions, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via (1) an invalid salt or a (2) DES or (3) MD5 encrypted password, when FIPS-140 is enable, to KDM or an (4) invalid password to KCheckPass.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

KDE — Kde-workspaceKDE — KDE SCOpensuse — Opensuse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4132",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-09-16T19:14:38.520",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00082.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00002.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://seclists.org/oss-sec/2013/q3/117",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://seclists.org/oss-sec/2013/q3/120",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://git.reviewboard.kde.org/r/111261/",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00082.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00002.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/oss-sec/2013/q3/117",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/oss-sec/2013/q3/120",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.reviewboard.kde.org/r/111261/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw_encrypt functions, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via (1) an invalid salt or a (2) DES or (3) MD5 encrypted password, when FIPS-140 is enable, to KDM or an (4) invalid password to KCheckPass."
    },
    {
      "lang": "es",
      "value": "KDE-Workspace 4.10.5 y anteriores no gestiona de forma adecuada el valor de retorno de glibc 2.17 crypt y  funciones pw_encrypt, lo que permite a atacantes remotos provocar una denegación de servicio \n(referencia a puntero nulo y cuelgue) a través de (1) un \"salt\" invalido o una contraseña cifrada, cuando FIPS-140 está habilitado, para KDM o una (4) contraseña no válida para KCheckPass."
    }
  ],
  "lastModified": "2026-06-16T23:56:41.093",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kde:kde-workspace:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0569889F-8059-4319-A20A-FD7A3809EE1E",
              "versionEndIncluding": "4.10.5"
            },
            {
              "criteria": "cpe:2.3:a:kde:kde_sc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D88BC24E-31F5-435C-9F07-AAAAF755AA19",
              "versionEndIncluding": "4.10.5"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D806A17E-B8F9-466D-807D-3F1E77603DC8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}