« Volver al listado

CVE-2016-3120

Estado: ModificadaMedia (6.5)—

The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

MIT — Kerberos 5

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-3120",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-08-01T02:59:12.370",
  "references": [
    {
      "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458",
      "tags": [
        "Issue Tracking"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2591.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://web.mit.edu/kerberos/krb5-1.13/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://web.mit.edu/kerberos/krb5-1.14/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/92132",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1036442",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2591.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://web.mit.edu/kerberos/krb5-1.13/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://web.mit.edu/kerberos/krb5-1.14/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/92132",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1036442",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."
    },
    {
      "lang": "es",
      "value": "La función validate_as_request en kdc_util.c en el Key Distribution Center (KDC) en MIT Kerberos 5 (también conocido como krb5) en versiones anteriores a 1.13.6 y 1.4.x en versiones anteriores a 1.14.3, cuando restrict_anonymous_to_tgt está activo, utiliza una estructura de datos de clientes incorrecta, lo que permite a usuarios remotos autenticados provocar una denegación de servicio (referencia al puntero NULO y caída de daemon) a través de una petición S4U2Selft."
    }
  ],
  "lastModified": "2026-06-17T00:45:00.557",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "169D00BD-344F-453C-BE7C-9DF0740080BB"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.13.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "765B3248-A524-4A79-858C-E787C1C1599E"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.13.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF1BB0AB-2C22-49F9-9D2A-074D2F711BA8"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.13.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8EC001E-9507-410D-836F-93002789D574"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.13.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC0939BF-9ACB-41A7-9B48-0FBF1176C8CB"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.13.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0037EF80-A599-4938-889F-9276E339A8E0"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.13.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CABFE58-4811-49EC-8565-35EB7D5F6F4C"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E30B176-1FE5-4C53-8B79-2E6D87DF05B3"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E650B5A3-99CA-491B-A1FB-259EF548D92E"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "091F3C51-980E-482F-9882-0A555A8F74BC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}