Search for vulnerabilities
Vulnerability details: VCID-dyyj-xzwf-aaae
Vulnerability ID VCID-dyyj-xzwf-aaae
Aliases CVE-2018-5709
Summary An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-190 Integer Overflow or Wraparound
System Score Found at
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-5709.json
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00463 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.00865 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
epss 0.08937 https://api.first.org/data/v1/epss?cve=CVE-2018-5709
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1535554
cvssv3 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 3.7 https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
generic_textual LOW https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2018-5709
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2018-5709
archlinux Medium https://security.archlinux.org/AVG-586
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-5709.json
https://api.first.org/data/v1/epss?cve=CVE-2018-5709
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
1535554 https://bugzilla.redhat.com/show_bug.cgi?id=1535554
889684 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889684
ASA-201806-3 https://security.archlinux.org/ASA-201806-3
AVG-586 https://security.archlinux.org/AVG-586
cpe:2.3:a:mit:kerberos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mit:kerberos:*:*:*:*:*:*:*:*
CVE-2018-5709 https://nvd.nist.gov/vuln/detail/CVE-2018-5709
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-5709.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-5709
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-5709
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.38744
EPSS Score 0.00087
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.