MIT Kerberos 5 up to 1.16 kadmin/dbutil/dump.c dbentry->n_key_data integer overflow

Summaryinfo

A vulnerability marked as critical has been reported in MIT Kerberos 5 up to 1.16. The impacted element is an unknown function of the file kadmin/dbutil/dump.c. The manipulation of the argument dbentry->n_key_data as part of Variable leads to integer overflow. This vulnerability is traded as CVE-2018-5709. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in MIT Kerberos 5 up to 1.16 (Network Authentication Software). This issue affects an unknown code of the file kadmin/dbutil/dump.c. The manipulation of the argument dbentry->n_key_data as part of a Variable leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

The bug was discovered 01/15/2018. The weakness was shared 01/16/2018 (Website). It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2018-5709 since 01/16/2018. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 12/29/2019).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-111900 is related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Network Authentication Software

Vendor

• MIT

Name

• Kerberos 5

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16

License

• open-source

Website

• Vendor: http://www.mit.edu/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion