Skip to main content

Kerberos CVE-2018-20217

MEDIUM
Reachable Assertion (CWE-617)
2018-12-26 cve@mitre.org
Denial Of Service Kerberos Debian Linux
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 26, 2018 - 21:29 nvd
MEDIUM 5.3

DescriptionNVD

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

AnalysisAI

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-617. A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request. Affected products include: Mit Kerberos, Debian Debian Linux. Version information: before 1.17..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Kerberos

View all
CVE-2020-13110 HIGH POC
7.8 May 16

The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of

CVE-2018-5709 HIGH
7.5 Jan 16

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. Rated high severity (CVSS 7.5), this vulnerability is
CVE-2017-11368 MEDIUM
6.5 Aug 09

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending inval
CVE-2014-4342 MEDIUM
5.0 Jul 20

MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffe
CVE-2018-5710 MEDIUM
6.5 Jan 16

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. Rated medium severity (CVSS 6.5), this vulnerability

CVE-2013-6800 MEDIUM
4.0 Nov 18

An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x all
CVE-2014-5354 LOW
3.5 Dec 16

plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KD

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6
CVE-2023-37020 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2018-20217 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy