CVE-2014-9422

The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before…

published February 19, 2015

CVSS
—
EPSS
3%
Percentile
86.0
In the wild
Unconfirmed
What it is

The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02726 · 86.0th percentile
Published
2015-02-19T11:00Z
EPSS history
Timeline
  • 19 FEB 11:00Z
    The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before…
    cvelistv5