← Back

CVE-2015-2694

nvd nist
Published: May 25, 2015Modified: May 6, 2026

JSON object

Loading...
5.8
Vector
AV:N/AC:M/Au:N/C:P/I:P/A:N
Exploitability: 8.6 / Impact: 4.9
Source: NVD

Description

The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.

Affected (6)

Products: Mit: Kerberos 5
Mit
1 product
Kerberos 5
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Mit
Kerberos 5
Version 1.12.1
Kerberos 5
Version 1.12.2
Kerberos 5
Version 1.12.3
Kerberos 5
Version 1.12
Kerberos 5
Version 1.13.1
Kerberos 5
Version 1.13

Related CWEs

CWE-264
CWE-264

References (10)

Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.