CVE-2014-9422 in Kerberos
Summary
The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Reservation
12/26/2014
Disclosure
02/19/2015
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 69039 | MIT Kerberos Key access control | 284 | Unproven | Official fix | CVE-2014-9422 |