What is the CVSS score of CVE-2013-1416?

CVE-2013-1416 has a CVSS 2.0 base score of 4.0 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. EPSS exploitation probability: 2.3%.

Is there a patch available for CVE-2013-1416?

Yes, a patch is available for CVE-2013-1416. Update the affected software to the latest version immediately.

Kerberos 5 CVE-2013-1416

MEDIUM

NULL Pointer Dereference (CWE-476)

2013-04-19 cve@mitre.org

Denial Of Service Null Pointer Dereference Kerberos 5 Opensuse Fedora Enterprise Linux Desktop Enterprise Linux Eus Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Workstation

4.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.0 MEDIUM

AV:N/AC:L/Au:S/C:N/I:N/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:N/I:N/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

None

Availability

Lifecycle Timeline

CVE Published

Apr 19, 2013 - 11:44 cve.org

MEDIUM 4.0

DescriptionCVE.org

The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.

AnalysisAI

The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

Technical ContextAI

This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request. Affected products include: Mit Kerberos 5, Opensuse, Fedoraproject Fedora, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus. Version information: before 1.10.5.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.